A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone.
This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 5
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Isc Bind
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
|
9.11.0
|
<= 9.18.50
|
|
Isc Bind
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
|
9.20.0
|
<= 9.20.27
|
|
Isc Bind
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
|
9.21.0
|
<= 9.21.25
|
|
Isc Bind
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
|
9.11.3-S1
|
<= 9.18.50-S1
|
|
Isc Bind
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
|
9.20.9-S1
|
<= 9.20.27-S1
|