Information disclosure in ISC BIND - CVE-2019-6465

Vulnerability identifier: #VU17828

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-6465

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable. A remote attacker can request and receive a zone transfer of a DLZ even when not permitted to do so by the allow-transfer ACL.

ISC BIND
Arch Linux
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Opensuse
Fedora
bind (Alpine package)
bind (Red Hat package) main
bind-pkcs11-libs
bind
bind-chroot
bind-devel
bind-export-devel
bind-export-libs
bind-libs
bind-libs-lite
bind-lite-devel
bind-pkcs11
bind-pkcs11-devel
bind-pkcs11-utils
bind-sdb
bind-sdb-chroot
bind-utils
bind-license
python3-bind
Data Computing Appliance (DCA)

The vulnerability has been fixed in the versions 9.11.5-P4, 9.12.3-P4.

ISC BIND - addressed in versions 9.11.5-P4, 9.12.3-P4
bind (Alpine package) - addressed in versions 9.11.5_p4-r0, 9.12.3_p4-r0
Data Computing Appliance (DCA) - update to 4.3.0.0
bind (Red Hat package) main - addressed in versions 9.11.4-16.P2.el7, 9.11.4-26.P2.el8
bind-pkcs11-libs - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-chroot - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-devel - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-export-devel - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-export-libs - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-libs - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-libs-lite - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-lite-devel - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-pkcs11 - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-pkcs11-devel - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-pkcs11-utils - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-sdb - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-sdb-chroot - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-utils - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind-license - addressed in versions 9.11.4-26.P2, 9.11.36-3
bind - addressed in versions 9.11.5-4.P4.fc28, 9.11.5-4.P4.fc29
python3-bind - update to 9.11.36-3

• https://kb.isc.org/docs/cve-2019-6465

• Information disclosure in ISC BIND
• OpenSUSE Linux update for bind
• OpenSUSE Linux update for bind
• Information disclosure in bind (Alpine package)
• Arch Linux update for bind
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Red Hat Enterprise Linux 8 update for bind
• Red Hat Enterprise Linux 7 update for bind
• Anolis OS update for bind (Anolis OS 8.6)
• Anolis OS update for bind
• Fedora 29 update for bind
• Fedora 28 update for bind