PT-2019-18108 · Isc+1 · Bind+1

Publicado 2019-10-16 · Atualizado 2020-08-24 · CVE-2019-6475

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions BIND versions 9.14.0 through 9.14.6 BIND versions 9.15.0 through 9.15.4

Description The issue arises from an error in the validity checks for incoming zone data in the mirror zone feature of BIND, allowing an on-path attacker to replace validated zone data with forged data. This feature is often used to serve a local copy of the root zone. If an attacker inserts themselves into the network path between a recursive server using a mirror zone and a root name server, they could cause the recursive server to accept falsified root zone data.

Recommendations For BIND versions 9.14.0 through 9.14.6, update to a version outside of this range to resolve the issue. For BIND versions 9.15.0 through 9.15.4, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the mirror zone feature until a patch is available. Restrict access to the mirror zone data to minimize the risk of exploitation.

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2019-6475

Produtos afetados

Bind

Bind Server

Referências · 7

• https://osv.dev/vulnerability/ALPINE-CVE-2019-6475 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-6475 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6475 · Nota de Segurança
• https://support.f5.com/csp/article/K42238532?utm_source=f5support&amp%3Butm_medium=RSS · Nota
• https://security.alpinelinux.org/vuln/CVE-2019-6475 · Nota
• https://security.netapp.com/advisory/ntap-20191024-0004 · Nota
• https://kb.isc.org/docs/cve-2019-6475 · Aviso do Fabricante