Information disclosure in bind (Alpine package)
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2019-6465 |
| CWE-ID | CWE-200 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
bind (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Information disclosure
EUVDB-ID: #VU17828
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-6465
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists due to controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable. A remote attacker can request and receive a zone transfer of a DLZ even when not permitted to do so by the allow-transfer ACL.
Install update from vendor's website.
Vulnerable software versionsbind (Alpine package): 9.9.4-r0 - 9.12.3-r0
External linkshttp://git.alpinelinux.org/aports/commit/?id=3e4647688661ad2aa06d7fc9a324b009c5f210af
http://git.alpinelinux.org/aports/commit/?id=3142e7931359e784a78891287108e92aefc4393c
http://git.alpinelinux.org/aports/commit/?id=d6ab6c12b91030e3c1d072ed36e093c2ebbc96cf
http://git.alpinelinux.org/aports/commit/?id=6a7a5020482526d5f8f38aa59bf9da6e245d2264
http://git.alpinelinux.org/aports/commit/?id=a72d66cd67f20dec8e4eb3d6f2b387a11a0bfbf8
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
