Multiple vulnerabilities have been discovered in ISC BIND, the worst of which could result in denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.16.33 | >= 9.16.33 |
| net-dns/bind-tools | * | < 9.16.33 | >= 9.16.33 |
ISC BIND is the Internet Systems Consortium implementation of the Domain Name System (DNS) protocol.
Multiple vulnerabilities have been discovered in ISC BIND. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All ISC BIND users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.16.33"
All ISC BIND-tools users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-tools-9.16.33"
Multiple vulnerabilities have been found in BIND, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.16.6 | >= 9.16.6 |
BIND (Berkeley Internet Name Domain) is a Name Server.
Multiple vulnerabilities have been discovered in BIND. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All BIND users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.16.6"
Multiple vulnerabilities have been found in BIND, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.12.1_p2-r1 | >= 9.12.1_p2-r1 |
BIND (Berkeley Internet Name Domain) is a Name Server.
Multiple vulnerabilities have been discovered in BIND. Please review the CVE identifiers referenced below for details.
BIND can improperly permit recursive query service to unauthorized clients possibly resulting in a Denial of Service condition or to be used in DNS reflection attacks.
There is no known workaround at this time.
All bind users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.12.1_p2-r1"
Multiple vulnerabilities have been found in BIND, the worst of which allows remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.11.1_p1 | >= 9.11.1_p1 |
BIND (Berkeley Internet Name Domain) is a Name Server.
Multiple vulnerabilities have been discovered in BIND. Please review the CVE identifiers referenced below for details.
A remote attacker could send a specially crafted DNS request to the BIND resolver resulting in a Denial of Service condition.
There is no known workaround at this time.
All BIND users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.11.1_p1"
A vulnerability in BIND might allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.10.4_p4 | >= 9.10.4_p4 |
BIND (Berkeley Internet Name Domain) is a Name Server.
A defect in BIND’s handling of responses containing a DNAME answer can cause a resolver to exit after encountering an assertion failure in db.c or resolver.c.
A remote attacker could send a specially crafted DNS request to the BIND resolver possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All BIND users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.10.4_p4"
Multiple vulnerabilities have been found in BIND, the worst of which could cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.10.4_p3 | >= 9.10.4_p3 |
BIND (Berkeley Internet Name Domain) is a Name Server.
Multiple vulnerabilities have been discovered in BIND. Please review the CVE identifiers referenced below for details.
A remote attacker could cause a Denial of Service condition through multiple attack vectors.
There is no known workaround at this time.
All BIND users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.10.4_p3"
A vulnerability in BIND could lead to a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.10.2_p4 | >= 9.10.2_p4 |
BIND (Berkeley Internet Name Domain) is a Name Server.
A vulnerability has been discovered in BIND’s named utility leading to a Denial of Service condition.
A remote attacker may be able to cause Denial of Service condition via specially constructed zone data.
There is no known workaround at this time.
All BIND users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.10.2_p4"
Multiple vulnerabilities have been found in BIND, allowing remote attackers to cause a denial of service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.10.1_p1 | >= 9.10.1_p1 |
BIND (Berkeley Internet Name Domain) is a Name Server.
Multiple vulnerabilities have been discovered in BIND. Please review the CVE identifiers referenced below for details.
A remote attacker can cause a denial of service condition by the lack of GeoIP databases, or via a large or infinite number of referrals.
There is no known workaround at this time.
All bind users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.10.1_p1"
Multiple vulnerabilities have been found in BIND, possibly resulting in Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.9.4_p2 | >= 9.9.4_p2 |
BIND is the Berkeley Internet Name Domain Server.
Multiple vulnerabilities have been discovered in BIND. Please review the CVE identifiers referenced below for details.
A remote attacker may be able to cause a Denial of Service condition.
There is no known workaround at this time.
All BIND users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.9.4_p2"
Multiple vulnerabilities have been found in BIND, the worst of which may allow remote Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.9.1_p3 | >= 9.9.1_p3 |
BIND is the Berkeley Internet Name Domain Server.
Multiple vulnerabilities have been discovered in BIND:
A remote attacker may be able to cause a Denial of Service condition or keep domain names resolvable after it has been deleted from registration.
There is no known workaround at this time.
All BIND users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.9.1_p3"
Multiple vulnerabilities have been found in BIND, the worst of which allowing to cause remote Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.7.4_p1 | >= 9.7.4_p1 |
BIND is the Berkeley Internet Name Domain Server.
Multiple vulnerabilities have been discovered in BIND. Please review the CVE identifiers referenced below for details.
The vulnerabilities allow remote attackers to cause a Denial of Service (daemon crash) via a DNS query, to bypass intended access restrictions, to incorrectly cache a ncache entry and a rrsig for the same type and to incorrectly mark zone data as insecure.
There is no known workaround at this time.
All bind users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.7.4_p1"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since December 22, 2011. It is likely that your system is already no longer affected by this issue.
Several cache poisoning vulnerabilities have been found in BIND.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.4.3_p5 | >= 9.4.3_p5 |
ISC BIND is the Internet Systems Consortium implementation of the Domain Name System (DNS) protocol.
Multiple cache poisoning vulnerabilities were discovered in BIND. For further information please consult the CVE entries and the ISC Security Bulletin referenced below.
Note: CVE-2010-0290 and CVE-2010-0382 exist because of an incomplete fix and a regression for CVE-2009-4022.
An attacker could exploit this weakness to poison the cache of a recursive resolver and thus spoof DNS traffic, which could e.g. lead to the redirection of web or mail traffic to malicious sites.
There is no known workaround at this time.
All BIND users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.4.3_p5"
Dynamic Update packets can cause a Denial of Service in the BIND daemon.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.4.3_p3 | >= 9.4.3_p3 |
ISC BIND is the Internet Systems Consortium implementation of the Domain Name System (DNS) protocol.
Matthias Urlichs reported that the dns_db_findrdataset() function fails when the prerequisite section of the dynamic update message contains a record of type "ANY" and where at least one RRset for this FQDN exists on the server.
A remote unauthenticated attacker could send a specially crafted dynamic update message to the BIND daemon (named), leading to a Denial of Service (daemon crash). This vulnerability affects all primary (master) servers -- it is not limited to those that are configured to allow dynamic updates.
Configure a firewall that performs Deep Packet Inspection to prevent nsupdate messages from reaching named. Alternatively, expose only secondary (slave) servers to untrusted networks.
All BIND users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.4.3_p3"
Incomplete verification of RSA and DSA certificates might lead to spoofed records authenticated using DNSSEC.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.4.3_p1 | >= 9.4.3_p1 |
ISC BIND is the Internet Systems Consortium implementation of the Domain Name System (DNS) protocol.
BIND does not properly check the return value from the OpenSSL functions to verify DSA (CVE-2009-0025) and RSA (CVE-2009-0265) certificates.
A remote attacker could bypass validation of the certificate chain to spoof DNSSEC-authenticated records.
There is no known workaround at this time.
All BIND users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.4.3_p1"
A weakness in the DNS protocol has been reported, which could lead to cache poisoning on recursive resolvers.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.4.2_p1 | >= 9.4.2_p1 |
ISC BIND is the Internet Systems Consortium implementation of the Domain Name System (DNS) protocol.
Dan Kaminsky of IOActive has reported a weakness in the DNS protocol related to insufficient randomness of DNS transaction IDs and query source ports.
An attacker could exploit this weakness to poison the cache of a recursive resolver and thus spoof DNS traffic, which could e.g. lead to the redirection of web or mail traffic to malicious sites.
There is no known workaround at this time.
All BIND users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.4.2_p1"
Note: In order to utilize the query port randomization to mitigate the weakness, you need to make sure that your network setup allows the DNS server to use random source ports for query and that you have not set a fixed query port via the "query-source port" directive in the BIND configuration.
The ISC BIND random number generator uses a weak algorithm, making it easier to guess the next query ID and perform a DNS cache poisoning attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.4.1_p1 | >= 9.4.1_p1 |
ISC BIND is the Internet Systems Consortium implementation of the Domain Name System (DNS) protocol.
Amit Klein from Trusteer reported that the random number generator of ISC BIND leads, half the time, to predictable (1 chance to 8) query IDs in the resolver routine or in zone transfer queries (CVE-2007-2926). Additionally, the default configuration file has been strengthen with respect to the allow-recursion{} and the allow-query{} options (CVE-2007-2925).
A remote attacker can use this weakness by sending queries for a domain he handles to a resolver (directly to a recursive server, or through another process like an email processing) and then observing the resulting IDs of the iterative queries. The attacker will half the time be able to guess the next query ID, then perform cache poisoning by answering with those guessed IDs, while spoofing the UDP source address of the reply. Furthermore, with empty allow-recursion{} and allow-query{} options, the default configuration allowed anybody to make recursive queries and query the cache.
There is no known workaround at this time for the random generator weakness. The allow-recursion{} and allow-query{} options should be set to trusted hosts only in /etc/bind/named.conf, thus preventing several security risks.
All ISC BIND users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.4.1_p1"
ISC BIND contains two vulnerabilities allowing a Denial of Service under certain conditions.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.3.4 | >= 9.3.4, >= 9.2.8 (revision) |
ISC BIND is the Internet Systems Consortium implementation of the Domain Name System (DNS) protocol.
An unspecified improper usage of an already freed context has been reported. Additionally, an assertion error could be triggered in the DNSSEC validation of some responses to type ANY queries with multiple RRsets.
A remote attacker could crash the server through unspecified vectors or, if DNSSEC validation is enabled, by sending certain crafted ANY queries.
There is no known workaround at this time for the first issue. The DNSSEC validation Denial of Service can be prevented by disabling DNSSEC validation until the upgrade to a fixed version. Note that DNSSEC validation is disabled on a default configuration.
All ISC BIND 9.3 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.3.4"
All ISC BIND 9.2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.2.8"
ISC BIND contains two vulnerabilities allowing a Denial of Service under certain conditions.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/bind | * | < 9.3.2-r4 | >= 9.3.2-r4, >= 9.2.6-r4 (revision) |
ISC BIND is the Internet Systems Consortium implementation of the Domain Name System (DNS) protocol.
Queries for SIG records will cause an assertion error if more than one SIG RRset is returned. Additionally, an INSIST failure can be triggered by sending multiple recursive queries if the response to the query arrives after all the clients looking for the response have left the recursion queue.
An attacker having access to a recursive server can crash the server by querying the SIG records where there are multiple SIG RRsets, or by sending many recursive queries in a short time. The exposure can be lowered by restricting the clients that can ask for recursion. An attacker can also crash an authoritative server serving a DNSSEC zone in which there are multiple SIG RRsets.
There are no known workarounds at this time.
All BIND 9.3 users should update to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.3.2-r4"
All BIND 9.2 users should update to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/bind-9.2.6-r4"