CVE-2019-6468 : Security Advisory and Response
Learn about CVE-2019-6468, a vulnerability in BIND Supported Preview Edition that can lead to an assertion failure when using the nxdomain-redirect feature. Find out how to mitigate the risks and prevent exploitation.
A vulnerability in BIND Supported Preview Edition could lead to an assertion failure when using the nxdomain-redirect function with certain versions. This issue affects versions 9.10.5-S1 to 9.11.5-S5.
Understanding CVE-2019-6468
BIND Supported Preview Edition may terminate unexpectedly due to an assertion failure when nxdomain-redirect is enabled with versions supporting EDNS Client Subnet (ECS) features.
What is CVE-2019-6468?
This CVE describes a vulnerability in BIND Supported Preview Edition that can cause the software to exit unexpectedly when the nxdomain-redirect feature is enabled in conjunction with ECS support.
The Impact of CVE-2019-6468
The vulnerability can be exploited by a malicious party to trigger an assertion failure in BIND, leading to a denial of service condition. The impact is rated as MEDIUM with a CVSS base score of 5.3.
Technical Details of CVE-2019-6468
The following technical details provide insight into the vulnerability and its implications.
Vulnerability Description
Enabling nxdomain-redirect in affected versions of BIND Supported Preview Edition with ECS support can result in BIND terminating unexpectedly due to an assertion failure.
Affected Systems and Versions
- Product: BIND 9 Supported Preview Edition
- Vendor: ISC
- Versions: BIND 9 9.10.5-S1 -> 9.11.5-S5
Exploitation Mechanism
If nxdomain-redirect is enabled in a vulnerable BIND release, a malicious actor can exploit the bug to cause BIND to exit.
Mitigation and Prevention
Taking immediate steps and implementing long-term security practices are crucial to mitigating the risks associated with CVE-2019-6468.
Immediate Steps to Take
- Disable the nxdomain-redirect feature in the nameserver's configuration to prevent exploitation of the vulnerability.
Long-Term Security Practices
- Regularly update BIND to the latest patched release to address known vulnerabilities.
Patching and Updates
Upgrade to the patched release most closely related to your current version of BIND, such as BIND 9.11.5-S6 or BIND 9.11.6-S1.