PT-2021-7348 · Isc+13 · Bind+13
Baojun Liu
+3
·
Published
2021-01-15
·
Updated
2026-01-30
·
CVE-2021-25220
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
BIND versions 9.11.0 through 9.11.36
BIND versions 9.12.0 through 9.16.26
BIND versions 9.17.0 through 9.18.0
BIND Supported Preview Editions versions 9.11.4-S1 through 9.11.36-S1
BIND Supported Preview Editions versions 9.16.8-S1 through 9.16.26-S1
BIND versions prior to 9.11.0, including Supported Preview Editions, are also believed to be affected but have not been tested as they are EOL.
Description
The issue is related to the handling of DNS queries, which could allow an attacker to poison the cache with incorrect records. This might lead to queries being made to the wrong servers and result in false information being returned to clients. The problem is associated with errors when using DNS forwarders.
Recommendations
For BIND versions 9.11.0 through 9.11.36, update to a version outside of this range to resolve the issue.
For BIND versions 9.12.0 through 9.16.26, update to a version outside of this range to resolve the issue.
For BIND versions 9.17.0 through 9.18.0, update to a version outside of this range to resolve the issue.
For BIND Supported Preview Editions versions 9.11.4-S1 through 9.11.36-S1, update to a version outside of this range to resolve the issue.
For BIND Supported Preview Editions versions 9.16.8-S1 through 9.16.26-S1, update to a version outside of this range to resolve the issue.
As a temporary workaround, consider restricting the use of DNS forwarders to minimize the risk of cache poisoning.
Fix
Assertion Failure
Improper Resource Release
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Bind
Bind Server
Centos
Ibm Aix
Junos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu