CVE-2013-4854
published 2013-07-29CVE-2013-4854: The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before…
PriorityP271high7.8CVSS 2.0
AVNACLAuNCNINAC
ITWVulnCheck KEV
Exploited in the wild
EPSS
34.15%
98.2th percentile
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.
Affected
49 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | bind9 | < bind9 1:9.8.4.dfsg.P1-6+nmu3 (bookworm) | bind9 1:9.8.4.dfsg.P1-6+nmu3 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| hp | hp-ux | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability is triggered by a specially crafted DNS query containing a malformed RDATA section, causing named to crash with an assertion failure in rdata.c during log message construction. Monitor for named assertion failure crashes (named daemon exit) as a potential exploitation indicator. ↗
- →Both recursive and authoritative-only nameservers are affected. Any named instance reachable by untrusted query sources is a valid target; scope detection to all named listener ports (typically UDP/TCP 53). ↗
- →The flaw was introduced with RFC 5011 support in BIND 9.7; versions prior to 9.7 are not affected. Fingerprint BIND version strings to identify vulnerable instances (9.7.x, 9.8.x before 9.8.5-P2, 9.9.x before 9.9.3-P2). ↗
- →The vulnerable code path is in rdata.c within the RFC 5011 implementation. Source-code-level or binary-level detection should focus on the rdata parsing and log-message construction routines in that file. ↗
- ·No workaround is available for vulnerable BIND versions; the only mitigation is patching to a fixed release (9.8.5-P2, 9.9.3-P2, or later). ↗
- ·BIND as shipped with Red Hat Enterprise Linux 5 (base bind package) is NOT affected; only bind97 on RHEL 5 and bind on RHEL 6 are affected. Ensure detection/patching scope is correctly targeted. ↗
CVSS provenance
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.8HIGH
vulncheck7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Bind vulnerability
vendor_ubuntu·2013-07-29
CVE-2013-4854 Bind vulnerability
Title: Bind vulnerability
Summary: Bind could be made to crash if it received specially crafted network
traffic.
Maxim Shudrak discovered that Bind incorrectly handled certain malformed
rdata. A remote attacker could use this flaw with a specially crafted
query to cause Bind to stop responding, resulting in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
BSD
FreeBSD-SA-13:07.bind: BIND remote denial of service
bsd_advisories·2013-07-26·CVSS 7.8
CVE-2013-4854 [HIGH] FreeBSD-SA-13:07.bind: BIND remote denial of service
FreeBSD-SA-13:07.bind Security Advisory
The FreeBSD Project
Topic: BIND remote denial of service
Category: contrib
Module: bind
Announced: 2013-07-26
Credits: Maxim Shudrak and the HP Zero Day Initiative, ISC
Affects: FreeBSD 8.4-RELEASE and FreeBSD 9.x
Corrected: 2013-07-26 22:53:17 UTC (stable/8, 8.4-STABLE)
2013-07-26 22:40:17 UTC (releng/8.4, 8.4-RELEASE-p2)
2013-07-26 22:43:09 UTC (stable/9, 9.2-BETA2)
2013-07-26 22:40:23 UTC (releng/9.1, 9.1-RELEASE-p5)
CVE Name: CVE-2013-4854
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
BIND 9 is an implementation of the Domain Name System (DNS) protocols.
The named(8) daemon is an Internet Domain Name Server
Red Hat
bind: named crash with an assertion failure on parsing malformed rdata
vendor_redhat·2013-07-26·CVSS 7.8
CVE-2013-4854 [HIGH] bind: named crash with an assertion failure on parsing malformed rdata
bind: named crash with an assertion failure on parsing malformed rdata
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.
Statement: This issue did not affect the versions of bind as shipped with Red Hat Enterprise Linux 5. It does affect the versions of bind97 as shipped with Red Hat Enterprise Linux 5 and the versions of bind as shipped with Red Hat Enterprise Linux 6.
Package: bind (Red Hat Enterprise Linux 5)
Debian
CVE-2013-4854: bind9 - The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-...
vendor_debian·2013·CVSS 7.8
CVE-2013-4854 [HIGH] CVE-2013-4854: bind9 - The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-...
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.
Scope: local
bookworm: resolved (fixed in 1:9.8.4.dfsg.P1-6+nmu3)
bullseye: resolved (fixed in 1:9.8.4.dfsg.P1-6+nmu3)
forky: resolved (fixed in 1:9.8.4.dfsg.P1-6+nmu3)
sid: resolved (fixed in 1:9.8.4.dfsg.P1-6+nmu3)
trixie: resolved (fixed in 1:9.8.4.dfsg.P1-6+nmu3)
GHSA
GHSA-pm36-8qh4-c679: The RFC 5011 implementation in rdata
ghsa_unreviewed·2022-05-14
CVE-2013-4854 [HIGH] GHSA-pm36-8qh4-c679: The RFC 5011 implementation in rdata
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.
OSV
CVE-2013-4854: The RFC 5011 implementation in rdata
osv·2013-07-29·CVSS 7.8
CVE-2013-4854 [HIGH] CVE-2013-4854: The RFC 5011 implementation in rdata
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.
VulnCheck
ISC BIND RFC 5011 Implementation in rdata.c Denial of Service
vulncheck·2013·CVSS 7.8
CVE-2013-4854 [HIGH] ISC BIND RFC 5011 Implementation in rdata.c Denial of Service
ISC BIND RFC 5011 Implementation in rdata.c Denial of Service
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.
Affected: isc bind
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://kb.isc.org/docs/aa-01015; https://www.cve.org/CVERecord?id=CVE-2013-4854
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-4854 bind: named will crash with an assertion failure on parsing malformed rdata [fedora-all]
bugzilla·2013-07-26·CVSS 7.8
CVE-2013-4854 [HIGH] CVE-2013-4854 bind: named will crash with an assertion failure on parsing malformed rdata [fedora-all]
CVE-2013-4854 bind: named will crash with an assertion failure on parsing malformed rdata [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Pl
Bugzilla
CVE-2013-4854 bind: named crash with an assertion failure on parsing malformed rdata
bugzilla·2013-07-26·CVSS 7.8
CVE-2013-4854 [HIGH] CVE-2013-4854 bind: named crash with an assertion failure on parsing malformed rdata
CVE-2013-4854 bind: named crash with an assertion failure on parsing malformed rdata
It was reported that when ISC implemented support for RFC 5011 in BIND 9.7, it inadvertently introduced a bug that would cause named to crash when receiving a specially crafted query which included malformed rdata. The named daemon would terminate with an assertion failure when rejecting the malformed query.
As this was introduced in BIND 9.7, earlier versions are unaffected by this flaw.
External References:
https://kb.isc.org/article/AA-01015/74/CVE-2013-4854%3A-A-specially-crafted-query-can-cause-BIND-to-terminate-abnormally.html
https://kb.isc.org/article/AA-01016
Discussion:
Created attachment 778891
fix for CVE-2013-4854
Relevant changes between 9.8.5-P1 and 9.8.5-P2.
---
Statement:
This i
arXiv
ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing
arxiv_fulltext·2023-10-04
ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing
: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing
https://faculty.sites.uci.edu/zhouli/research/ Qifan Zhang ,
https://faculty.sites.uci.edu/zhouli/research/ Xuesong Bai ,
https://netsec.ccert.edu.cn/people/lx19 Xiang Li ,
https://netsec.ccert.edu.cn/people/duanhx/ Haixin Duan ,
https://netsec.ccert.edu.cn/people/qli/ Qi Li , and
https://faculty.sites.uci.edu/zhouli/ Zhou Li
Corresponding authors. Most of Xiang Li's work was done when visiting UCI as a project specialist.
https://uci.edu/University of California, Irvine,
https://www.tsinghua.edu.cn/en/Tsinghua University
Zhongguancun Laboratory,
https://www.qcl.edu.cn/Quan Cheng Laboratory
## Abstract
Domain Name System (DNS) is a critical component of the Internet. DNS resolvers, which act as the cache
http://archives.neohapsis.com/archives/bugtraq/2013-08/0030.htmlhttp://archives.neohapsis.com/archives/bugtraq/2014-10/0103.htmlhttp://linux.oracle.com/errata/ELSA-2014-1244http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113108.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-August/113251.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-08/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-08/msg00018.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1114.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1115.htmlhttp://secunia.com/advisories/54134http://secunia.com/advisories/54185http://secunia.com/advisories/54207http://secunia.com/advisories/54211http://secunia.com/advisories/54323http://secunia.com/advisories/54432http://www.debian.org/security/2013/dsa-2728http://www.freebsd.org/security/advisories/FreeBSD-SA-13:07.bind.aschttp://www.mandriva.com/security/advisories?name=MDVSA-2013:202http://www.securityfocus.com/bid/61479http://www.securitytracker.com/id/1028838http://www.ubuntu.com/usn/USN-1910-1http://www.zerodayinitiative.com/advisories/ZDI-13-210/https://exchange.xforce.ibmcloud.com/vulnerabilities/86004https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03922396https://kb.isc.org/article/AA-01015https://kb.isc.org/article/AA-01016https://kc.mcafee.com/corporate/index?page=content&id=SB10052https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19561https://support.apple.com/kb/HT6536http://archives.neohapsis.com/archives/bugtraq/2013-08/0030.htmlhttp://archives.neohapsis.com/archives/bugtraq/2014-10/0103.htmlhttp://linux.oracle.com/errata/ELSA-2014-1244http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113108.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-August/113251.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-08/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-08/msg00018.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1114.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1115.htmlhttp://secunia.com/advisories/54134http://secunia.com/advisories/54185http://secunia.com/advisories/54207http://secunia.com/advisories/54211http://secunia.com/advisories/54323http://secunia.com/advisories/54432http://www.debian.org/security/2013/dsa-2728http://www.freebsd.org/security/advisories/FreeBSD-SA-13:07.bind.aschttp://www.mandriva.com/security/advisories?name=MDVSA-2013:202http://www.securityfocus.com/bid/61479http://www.securitytracker.com/id/1028838http://www.ubuntu.com/usn/USN-1910-1http://www.zerodayinitiative.com/advisories/ZDI-13-210/https://exchange.xforce.ibmcloud.com/vulnerabilities/86004https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03922396https://kb.isc.org/article/AA-01015https://kb.isc.org/article/AA-01016https://kc.mcafee.com/corporate/index?page=content&id=SB10052https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19561https://support.apple.com/kb/HT6536
2013-07-29
Published
Exploited in the wild