Assertion failure in ISC BIND - CVE-2009-0696

Vulnerability identifier: #VU6168

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2009-0696

CWE-ID: CWE-617

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to assertion failure in dns_db_findrdataset() function within db.c when named is configured as a master server. A remote unauthenticated attacker can send an ANY record in the prerequisite section of a crafted dynamic update message and trigger assertion failure and daemon exit.

Successful exploitation of this vulnerability may allow an attacker to perform denial of service (DoS) attack.

Note: this vulnerability is being actively exploited.

ISC BIND

Debian Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
SUSE Linux

Update to version 9.4.3-P3, 9.5.1-P3 or 9.6.1-P1.

• Exploit #9046 - CVEs (Collection of Exploits for CVEs) (May 7, 2023)
• Exploit #1141 - ISC BIND 9 - Remote Dynamic Update Message Denial of Service (PoC) (March 18, 2020)

• https://www.kb.cert.org/vuls/id/725188

• Remote denial of service in ISC BIND
• Ubuntu update for Bind
• Debian update for bind9
• Gentoo update for BIND
• Slackware Linux update for bind
• openSUSE update for flash-player
• Red Hat update for bind