PT-2019-18108 · Isc+1 · Bind+1

Published 2019-10-16 · Updated 2020-08-24 · CVE-2019-6475

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions BIND versions 9.14.0 through 9.14.6 BIND versions 9.15.0 through 9.15.4

Description The issue arises from an error in the validity checks for incoming zone data in the mirror zone feature of BIND, allowing an on-path attacker to replace validated zone data with forged data. This feature is often used to serve a local copy of the root zone. If an attacker inserts themselves into the network path between a recursive server using a mirror zone and a root name server, they could cause the recursive server to accept falsified root zone data.

Recommendations For BIND versions 9.14.0 through 9.14.6, update to a version outside of this range to resolve the issue. For BIND versions 9.15.0 through 9.15.4, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the mirror zone feature until a patch is available. Restrict access to the mirror zone data to minimize the risk of exploitation.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2019-6475

Affected Products

Bind

Bind Server

References · 7

• https://osv.dev/vulnerability/ALPINE-CVE-2019-6475 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6475 · Security Note
• https://kb.isc.org/docs/cve-2019-6475 · Vendor Advisory
• https://support.f5.com/csp/article/K42238532?utm_source=f5support&amp%3Butm_medium=RSS · Note
• https://security.alpinelinux.org/vuln/CVE-2019-6475 · Note
• https://security.netapp.com/advisory/ntap-20191024-0004 · Note