Debian Bind9 vulnerabilities

CVE-2016-2776 [HIGH] CVE-2016-2776: bind9 - buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.... buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query. Scope: local bookworm: resolved (fixed in 1:9.10.3.dfsg.P4-11) bullseye: resolved (fixed in 1:9.10.3.dfsg.P4-11) fo

CVE-2015-5477 [HIGH] CVE-2015-5477: bind9 - named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote ... named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries. Scope: local bookworm: resolved (fixed in 1:9.9.5.dfsg-11) bullseye: resolved (fixed in 1:9.9.5.dfsg-11) forky: resolved (fixed in 1:9.9.5.dfsg-11) sid: resolved (fixed in 1:9.9.5.dfsg-11) tr

CVE-2009-0696 [MEDIUM] CVE-2009-0696: bind9 - The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P... The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message. Scope: local bookworm: resolved (

CVE-2013-4854 [HIGH] CVE-2013-4854: bind9 - The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-... The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during constructi

CVE-2008-1447 [MEDIUM] CVE-2008-1447: adns - The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, ... The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to i

CVE-2020-8617 [HIGH] CVE-2020-8617: bind9 - Using a specially-crafted message, an attacker may potentially cause a BIND serv... Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulne

CVE-2021-25216 [HIGH] CVE-2021-25216: bind9 - In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11... In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which

CVE-2020-8625 [HIGH] CVE-2020-8625: bind9 - BIND servers are vulnerable if they are running an affected version and are conf... BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the d

CVE-2023-50387 [HIGH] CVE-2023-50387: bind9 - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and r... Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must eval

CVE-2018-5740 [HIGH] CVE-2018-5740: bind9 - "deny-answer-aliases" is a little-used feature intended to help recursive server... "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.

CVE-2023-50868 [HIGH] CVE-2023-50868: bind9 - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276... The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash

CVE-2016-1286 [HIGH] CVE-2016-1286: bind9 - named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote ... named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c. Scope: local bookworm: resolved (fixed in 1:9.10.3.dfsg.P4-6) bullseye: resolved (fixed in 1:9.10.3.dfsg.P4-6) forky: resolved (fixed

CVE-2022-3736 [HIGH] CVE-2022-3736: bind9 - BIND 9 resolver can crash when stale cache and stale answers are enabled, option... BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1. Scope: local bookworm: resolved (fixed in 1:9.1

CVE-2006-0987 [MEDIUM] CVE-2006-0987: bind9 - The default configuration of ISC BIND before 9.4.1-P1, when configured as a cach... The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses. Scope: local bookworm: resolved (fixed in

CVE-2014-8500 [HIGH] CVE-2014-8500: bind9 - ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 doe... ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals. Scope: local bookworm: resolved (fixed in 1:9.9.5.dfsg-7) bullseye: resolved (fixed in 1:9.9.5.dfsg-7) forky: resolved

CVE-2017-3145 [HIGH] CVE-2017-3145: bind9 - BIND was improperly sequencing cleanup operations on upstream recursion fetch co... BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1. Scope: local bookworm: res

CVE-2016-8864 [HIGH] CVE-2016-8864: bind9 - named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x befor... named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c. Scope: local bookworm: resolved (fixed in 1:9.10.3.dfsg.P4-11) bullseye: resolved

CVE-2024-12705 [HIGH] CVE-2024-12705: bind9 - Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memor... Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1. Scope: local bookworm: resolved (fixed in 1:9.18.33-1~deb12u2) bullseye: resolved forky

CVE-2016-9131 [HIGH] CVE-2016-9131: bind9 - named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x befor... named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query. Scope: local bookworm: resolved (fixed in 1:9.10.3.dfsg.P4-11) bullseye: resolved (fixed in 1:9.10.3.dfsg.P4-11) forky: resolved (fixed in 1:9.

CVE-2016-1285 [MEDIUM] CVE-2016-1285: bind9 - named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not prope... named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c. Scope: local bookworm: resolved (fi