PT-2019-4284 · Isc+6 · Bind+6

Published 2019-11-20 · Updated 2024-06-15 · CVE-2019-6477

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions BIND versions (affected versions not specified)

Description The issue is related to pipelining in BIND, where each incoming query on a TCP connection requires significant resource allocation. A client using a TCP-pipelined connection could consume more resources than the server is provisioned to handle, leading to the server becoming unresponsive when a TCP connection with multiple pipelined queries is closed. This can be perceived as an intermittent server problem. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2019-3172

ALT-PU-2019-3186

BDU:2019-04891

CESA-2020_1061

CESA-2020_1845

CVE-2019-6477

DSA-4689-1

MGASA-2020-0259

OPENSUSE-SU-2020:1699-1

OPENSUSE-SU-2020:1701-1

OPENSUSE-SU-2020_1699-1

OPENSUSE-SU-2020_1701-1

OPENSUSE-SU-2024:10650-1

RHSA-2020:1061

RHSA-2020:1845

RHSA-2020_1061

RHSA-2020_1845

SUSE-SU-2020:2914-1

USN-4197-1

Affected Products

Alt Linux

Bind

Bind Server

Centos

Red Hat

Suse

Ubuntu

References · 148

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/dns/bind_tsig_badtime.rb · Exploit
• 🔥 https://github.com/knqyf263/CVE-2020-8617 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-6477 · Security Note
• https://security-tracker.debian.org/tracker/source-package/bind9 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02673 · Security Note
• https://osv.dev/vulnerability/MGASA-2020-0259 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4197-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-1061.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6471 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6477 · Security Note
• https://errata.altlinux.org/ALT-PU-2019-3186 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00773 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-6477 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04891 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8616 · Security Note