// For flags

CVE-2019-6467

An error in the nxdomain redirect feature can cause BIND to exit with an INSIST assertion failure in query.c

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. The most likely scenario where this might occur is if the server, in addition to performing NXDOMAIN redirection for recursive clients, is also serving a local copy of the root zone or using mirroring to provide the root zone, although other configurations are also possible. Versions affected: BIND 9.12.0-> 9.12.4, 9.14.0. Also affects all releases in the 9.13 development branch.

Un error de programación en la funcionalidad nxdomain-redirect puede causar un error de aserción en el archivo query.c, si el espacio de nombres alternativo utilizado por nxdomain-redirect es un descendiente de una zona que es servida localmente. El escenario más probable en el que esto podría presentarse es si el servidor, además de realizar el redireccionamiento de NXDOMAIN para clientes recursivos, también está sirviendo una copia local de la zona root o utilizando la duplicación para proveer la zona root, aunque también son posibles otras configuraciones. Versiones afectadas: BIND 9.12.0 hasta 9.12.4, y 9.14.0. También afecta a todas las versiones en la rama de desarrollo 9.13.

*Credits: ISC would like to thank Quad9 for reporting this issue.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-01-16 CVE Reserved
  • 2019-04-25 First Exploit
  • 2019-10-09 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-617: Reachable Assertion
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Isc
Search vendor "Isc"
 Bind
Search vendor "Isc" for product "Bind"
 >= 9.12.0 <= 9.12.4
Search vendor "Isc" for product "Bind" and version " >= 9.12.0 <= 9.12.4"
-
Affected
Isc
Search vendor "Isc"
 Bind
Search vendor "Isc" for product "Bind"
 >= 9.13.0 <= 9.13.7
Search vendor "Isc" for product "Bind" and version " >= 9.13.0 <= 9.13.7"
-
Affected
Isc
Search vendor "Isc"
 Bind
Search vendor "Isc" for product "Bind"
 9.14.0
Search vendor "Isc" for product "Bind" and version "9.14.0"
-
Affected