BIND 9 vulnerabilities

Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This vulnerability affects specific versions of BIND 9.

CVE-1999-0024 vulnerability involves a malicious attack on DNS cache via BIND, exploiting predictable query IDs.

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. Affected versions include BIND 9.11.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23, and S1 versions.

BIND 9 in certain versions may exit unexpectedly with an assertion while validating proof if a domain is covered by both NSEC and NSEC3 records and an RRSIG exists for only one type.

BIND 9 contains a vulnerability that causes unexpected termination of the named process. The issue occurs with specific ordering of responses to queries for CNAME, DNAME, and A records when the authoritative server delays the response.

In BIND 9, an attacker can respond to a query with an RRSIG having fewer labels than the zone, causing a wildcard name for a shorter zone, leading to cache poisoning. This requires synth-from-dnssec yes (default).

A DNSSEC validating resolver under a random subdomain attack can suffer from runaway memory usage, exceeding the max-cache-size limit. The attacker needs to send queries faster than the resolver can validate.

Resource exhaustion vulnerability in BIND related to DNSSEC validation. The server always validates all RRSIG records in a response, even if unnecessary, leading to excessive CPU usage.

BIND 9 has a vulnerability in RPZ processing with wildcard CNAME policies. An attacker can send a query with a long name triggering a NAMETOOLONG error, which may lead to bypassing RPZ rules or an unexpected exit of BIND 9.

A flaw in BIND 9: accepting an invalid data structure in a DNS record (PRIVATEDNS algorithm with incorrect length) can cause the server to abort when rendering the record to text.

BIND may accept incorrect child-zone NSEC3 records as valid, allowing an attacker to forge authenticated NXDOMAIN responses. This affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and corresponding -S1 versions.

An unbounded resend loop in the BIND 9 resolver state machine during bad-server handling. A remote unauthenticated attacker can cause severe resource exhaustion by sending queries that trigger specific retry conditions.

A use-after-free vulnerability due to a race condition exists in BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. During SIG(0) signature validation, if the 'recursive-clients' limit is reached and the message is discarded, validation may attempt to read the discarded message. Versions 9.18.28-9.18.49 and 9.18.28-S1-9.18.49-S1 are not affected.

Multiple flaws in `named` related to handling DNS messages with non-IN classes (e.g., CHAOS, HESIOD) or meta-classes (ANY, NONE). Specially crafted requests can cause assertion failures in `named`.

A use-after-free vulnerability in the DNS-over-HTTPS implementation in BIND 9 versions 9.20.0-9.20.22, 9.21.0-9.21.21, and 9.20.9-S1-9.20.22-S1. Versions 9.18.x are not affected.

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver queries a specially crafted zone, it will consume disproportionate resources. Affects multiple BIND 9 versions.

Vulnerability in BIND servers configured to use TKEY authentication with GSS-API tokens. Receiving crafted packets can lead to excessive memory consumption, resulting in Denial of Service.

A specially crafted domain can cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.

Excessive CPU consumption vulnerability in BIND 9 resolver during DNSSEC validation when encountering a maliciously crafted zone. Authoritative servers are generally unaffected but may make recursive queries in some cases.

CVE-1999-0849 affects the BIND service, which can be vulnerable to a denial of service (DoS) attack via the maxdname parameter. An attacker can cause the DNS server to stop responding to queries.

CVE-1999-0837 vulnerability affects BIND service, which can be subject to a denial of service (DoS) attack due to improper closing of TCP sessions via so_linger.

Vulnerability in BIND causing denial of service via malformed SIG records.

CVE-1999-0851 vulnerability affects BIND service, which can be exploited for a denial of service (DoS) attack via NAPTR records.

Buffer overflow in BIND 8.2 via NXT records may lead to unauthorized access or service disruption.

Denial of Service vulnerability in BIND 8 Releases that can be exploited via maliciously formatted DNS messages.