CVE-2013-3919
HighSummary
W pliku resolver.c w ISC BIND w wersjach 9.8.5 przed 9.8.5-P1, 9.9.3 przed 9.9.3-P1 oraz 9.6-ESV-R9 przed 9.6-ESV-R9-P1, skonfigurowany rekurencyjny resolver pozwala zdalnym atakującym na spowodowanie odmowy usługi (awaria asercji i wyjście demona named) poprzez zapytanie o rekord w źle sformatowanej strefie.
Risk Assessment
Atakujący mogą wykorzystać tę podatność do zakłócenia działania serwera DNS, co może prowadzić do przerw w dostępności usług internetowych dla użytkowników organizacji.
Recommendation
Zaleca się aktualizację ISC BIND do najnowszej wersji, aby usunąć tę podatność oraz monitorowanie logów serwera w celu wykrycia potencjalnych prób ataków.
Related vulnerabilities
- CVE-2026-87886HighActively exploited
Local privilege escalation due to insecure file permissions. Affects Acronis Backup plugins for cPanel & WHM, Plesk, and DirectAdmin in versions older than the specified builds.
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85889Critical
Missing authentication for a critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-85885Critical
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- CVE-2026-83944Critical
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-77903Critical
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70200Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69865Critical
Authorization bypass through a user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
Original NVD description (English source)
resolver.c in ISC BIND 9.8.5 before 9.8.5-P1, 9.9.3 before 9.9.3-P1, and 9.6-ESV-R9 before 9.6-ESV-R9-P1, when a recursive resolver is configured, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a record in a malformed zone.