CVE-2019-6476
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| ISC | BIND 9 | 9.14.0 up to 9.14.6 | affected |
| ISC | BIND 9 | 9.15.0 up to 9.15.4 | affected |
Weaknesses
- An attacker who manages to deliberately trigger this condition on a server which is performing recursion can cause named to exit, denying service to clients.
Workarounds
ervers which have QNAME minimization turned on are potentially vulnerable to this defect if they are running an affected version of BIND. The vulnerability can be avoided by disabling QNAME minimization using "qname-minimization disabled;" in the global options section of named.conf (Note: the default value for the qname-minimization setting in the 9.14 and 9.15 branches is "relaxed". To make use of this workaround it must be explicitly disabled.)
ADP Enrichment
CVE Program Container
Additional References
- https://kb.isc.org/docs/cve-2019-6476
- https://security.netapp.com/advisory/ntap-20191024-0004/
- https://support.f5.com/csp/article/K42238532?utm_source=f5support&%3Butm_medium=RSS
References
- https://kb.isc.org/docs/cve-2019-6476
- https://security.netapp.com/advisory/ntap-20191024-0004/
- https://support.f5.com/csp/article/K42238532?utm_source=f5support&%3Butm_medium=RSS
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.