github - ghsa-7rr8-wvj2-chhv

ghsa-7rr8-wvj2-chhv

Vulnerability from github

Published

2022-05-24 16:59

Modified

2024-04-04 02:31

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4.

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-6476"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-617"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-10-17T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4.",
  "id": "GHSA-7rr8-wvj2-chhv",
  "modified": "2024-04-04T02:31:15Z",
  "published": "2022-05-24T16:59:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6476"
    },
    {
      "type": "WEB",
      "url": "https://kb.isc.org/docs/cve-2019-6476"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20191024-0004"
    },
    {
      "type": "WEB",
      "url": "https://support.f5.com/csp/article/K42238532?utm_source=f5support\u0026amp%3Butm_medium=RSS"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2019-6476 (GCVE-0-2019-6476)

Vulnerability from cvelistv5

Published

2019-10-17 19:17

Modified

2024-09-16 16:58

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

An attacker who manages to deliberately trigger this condition on a server which is performing recursion can cause named to exit, denying service to clients.

Summary

A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4.

References

URL

Tags

	https://kb.isc.org/docs/cve-2019-6476	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20191024-0004/	x_refsource_CONFIRM
	https://support.f5.com/csp/article/K42238532?utm_source=f5support&amp%3Butm_medium=RSS	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	ISC	BIND 9	Version: 9.14.0 up to 9.14.6 Version: 9.15.0 up to 9.15.4

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:23:20.982Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kb.isc.org/docs/cve-2019-6476"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20191024-0004/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K42238532?utm_source=f5support\u0026amp%3Butm_medium=RSS"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BIND 9",
          "vendor": "ISC",
          "versions": [
            {
              "status": "affected",
              "version": "9.14.0 up to 9.14.6"
            },
            {
              "status": "affected",
              "version": "9.15.0 up to 9.15.4"
            }
          ]
        }
      ],
      "datePublic": "2019-10-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An attacker who manages to deliberately trigger this condition on a server which is performing recursion can cause named to exit, denying service to clients.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-19T20:06:56",
        "orgId": "404fd4d2-a609-4245-b543-2c944a302a22",
        "shortName": "isc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kb.isc.org/docs/cve-2019-6476"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20191024-0004/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.f5.com/csp/article/K42238532?utm_source=f5support\u0026amp%3Butm_medium=RSS"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to the patched release most closely related to your current version of BIND:\n   +  BIND 9.14.7\n   +  BIND 9.15.5"
        }
      ],
      "source": {
        "discovery": "USER"
      },
      "title": "An error in QNAME minimization code can cause BIND to exit with an assertion failure",
      "workarounds": [
        {
          "lang": "en",
          "value": "ervers which have QNAME minimization turned on are potentially vulnerable to this defect if they are running an affected version of BIND. The vulnerability can be avoided by disabling QNAME minimization using \"qname-minimization disabled;\" in the global options section of named.conf (Note: the default value for the qname-minimization setting in the 9.14 and 9.15 branches is \"relaxed\". To make use of this workaround it must be explicitly disabled.)"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.8"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-officer@isc.org",
          "DATE_PUBLIC": "2019-10-16T17:36:53.000Z",
          "ID": "CVE-2019-6476",
          "STATE": "PUBLIC",
          "TITLE": "An error in QNAME minimization code can cause BIND to exit with an assertion failure"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIND 9",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "9.14.0 up to 9.14.6"
                          },
                          {
                            "version_value": "9.15.0 up to 9.15.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ISC"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.8"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "An attacker who manages to deliberately trigger this condition on a server which is performing recursion can cause named to exit, denying service to clients."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kb.isc.org/docs/cve-2019-6476",
              "refsource": "CONFIRM",
              "url": "https://kb.isc.org/docs/cve-2019-6476"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20191024-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20191024-0004/"
            },
            {
              "name": "https://support.f5.com/csp/article/K42238532?utm_source=f5support\u0026amp;utm_medium=RSS",
              "refsource": "CONFIRM",
              "url": "https://support.f5.com/csp/article/K42238532?utm_source=f5support\u0026amp;utm_medium=RSS"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Upgrade to the patched release most closely related to your current version of BIND:\n   +  BIND 9.14.7\n   +  BIND 9.15.5"
          }
        ],
        "source": {
          "discovery": "USER"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "ervers which have QNAME minimization turned on are potentially vulnerable to this defect if they are running an affected version of BIND. The vulnerability can be avoided by disabling QNAME minimization using \"qname-minimization disabled;\" in the global options section of named.conf (Note: the default value for the qname-minimization setting in the 9.14 and 9.15 branches is \"relaxed\". To make use of this workaround it must be explicitly disabled.)"
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22",
    "assignerShortName": "isc",
    "cveId": "CVE-2019-6476",
    "datePublished": "2019-10-17T19:17:39.240770Z",
    "dateReserved": "2019-01-16T00:00:00",
    "dateUpdated": "2024-09-16T16:58:26.060Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.