CVE-2020-8619

CVE-2020-8619 affects ISC BIND9: versions 9.11.14–9.11.19, 9.14.9–9.14.12, and 9.16.0–9.16.3 are vulnerable. The root cause is an asterisk (*) in an empty non-terminal location in the DNS graph, which can trigger an assertion in rbtdb.c and cause denial of service. Exploitation would require zone...

CVE-2018-5745

CVE-2018-5745 affects BIND's managed-keys feature, causing an assertion failure (and possible server exit) when a trust anchor is rolled over to an unsupported key algorithm. Affected: BIND 9 series (various 9.9.x–9.13.x branches and preview releases). Impact: potential denial of service by crash...

CVE-2020-8624

CVE-2020-8624 affects BIND's update-policy rules of type "subdomain". The flaw allows an attacker with limited zone-content privileges to modify other zone contents. Reports across distros indicate the vulnerability impacts various BIND 9.x releases; confirmed fixes include patched BIND versions ...

CVE-2009-0696

CVE-2009-0696 affects ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1. When a BIND master server processes a crafted dynamic update message containing an ANY prerequisite, an attacker can trigger an assertion failure that causes named to exit, i.e., a denial-of-service ...

CVE-2020-8618

CVE-2020-8618 affects BIND. An assertion in rdataset.c can be incorrectly triggered by large zone transfers, allowing a remote attacker to deny service to clients. Public advisories confirm mitigation via upgrading to BIND 9.16.4+ (e.g., Arch Linux ASA-202006-13 lists 9.16.4-1 as the fix; upstrea...

CVE-2010-0097

CVE-2010-0097 affects ISC BIND 9.x where DNSSEC validation of NSEC/NSEC3 records is flawed, enabling remote attackers to add the AD flag to forged NXDOMAIN responses for an existing domain. Public advisories confirm fixes in later BIND releases (upstream: 9.6-ESV-R1 and 9.7.0.dfsg) and point to u...

CVE-2010-0290

CVE-2010-0290 is described in connected F5 advisories as an ISC BIND cache-poisoning vulnerability affecting BIND 9.0.x–9.3.x, 9.4 up to 9.4.3-P5, 9.5 up to 9.5.2-P2, 9.6 up to 9.6.1-P3, and 9.7.0 beta, when DNSSEC validation is enabled and CD checking is disabled. The attack involves receiving a...

CVE-2007-2926

CVE-2007-2926 affects ISC BIND 9.x up to 9.5.0a5, where the DNS query ID generator used during answering resolver questions or sending NOTIFY messages uses a weak RNG. This enables a remote attacker to more easily guess query IDs and poison caches. The issue is specific to outgoing queries from B...

CVE-2010-3613

CVE-2010-3613 affects BIND (named) in versions 9.6.2 before 9.6.2-P3, 9.6-ESV before 9.6-ESV-R3, and 9.7.x before 9.7.2-P3. The issue arises from how signed negative responses and corresponding RRSIG records are handled in the cache, enabling remote attackers to cause a denial of service (daemon ...

CVE-2010-3762

ISC BIND before 9.7.2-P2 with DNSSEC validation enabled is vulnerable when multiple trust anchors exist for a zone, allowing remote attackers to trigger a denial of service (daemon crash) via a DNS query. Affected products/contexts shown in connected advisories (e.g., F5 SOL15172, Debian/Oracle/L...

CVE-2012-3868

CVE-2012-3868 concerns ISC BIND 9.9.x prior to 9.9.1-P2, where a race condition in ns_client structure management can be exploited by a high volume of TCP queries to cause a denial of service (memory consumption or process exit). The description specifies the underlying cause as a race condition ...

CVE-2003-0914

CVE-2003-0914 affects ISC BIND 8.3.x before 8.3.7 and 8.4.x before 8.4.3. A remote attacker can poison the DNS cache by using a malicious nameserver that returns negative responses with a large TTL, causing legitimate queries to be answered with cached negative results. Remediation mentioned in t...

CVE-2007-0494

CVE-2007-0494 affects ISC BIND: remote attackers can cause a denial of service via a DNS response to a type ANY query that contains multiple RRsets, triggering an assertion error in DNSSEC validation. Affected software includes BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up t...

CVE-2007-2930

CVE-2007-2930 affects ISC BIND 8 up to 8.4.7-P1, where the NSID_SHUFFLE_ONLY and NSID_USE_POOL PRNGs generate predictable DNS query IDs when the resolver sends outgoing queries (e.g., NOTIFY). This weakness enables remote attackers to poison DNS caches via unknown vectors. The advisory notes this...

CVE-2005-0034

CVE-2005-0034 concerns BIND 9.3.0 where an “incorrect assumption” in the authvalidated validator function, active when DNSSEC is enabled, lets remote attackers cause a denial of service by sending crafted DNS packets that trigger a failing self-check and cause named to exit. The issue is document...