CVE-2019-6471 Explained : Impact and Mitigation
Learn about CVE-2019-6471, a BIND vulnerability causing assertion failure. Discover impact, affected versions, and mitigation steps to secure your systems.
A race condition when discarding malformed packets can cause BIND to exit with an assertion failure.
Understanding CVE-2019-6471
This CVE involves a vulnerability in BIND affecting various versions.
What is CVE-2019-6471?
The occurrence of a race condition during the rejection of malformed packets can cause BIND to terminate due to a REQUIRE assertion failure in dispatch.c. This vulnerability impacts versions including BIND 9.11.0 to 9.11.7, 9.12.0 to 9.12.4-P1, and 9.14.0 to 9.14.2.
The Impact of CVE-2019-6471
- Attack Vector: Network
- Attack Complexity: High
- Availability Impact: High
- Base Score: 5.9 (Medium Severity)
- Privileges Required: None
- Scope: Unchanged
- User Interaction: None
- Vector String: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- An attacker exploiting this vulnerability can cause denial of service by making named exit.
Technical Details of CVE-2019-6471
This section provides detailed technical information about the vulnerability.
Vulnerability Description
A race condition during the rejection of malformed packets can lead to BIND exiting with an assertion failure in dispatch.c.
Affected Systems and Versions
- BIND 9.11.0 to 9.11.7
- BIND 9.12.0 to 9.12.4-P1
- BIND 9.14.0 to 9.14.2
- All releases of the BIND 9.13 development branch
- Version 9.15.0 of the BIND 9.15 development branch
- BIND Supported Preview Edition versions 9.11.3-S1 to 9.11.7-S1
Exploitation Mechanism
An attacker causing a resolver to perform queries answered by a server with deliberately malformed responses can trigger the vulnerability.
Mitigation and Prevention
Protect your systems from CVE-2019-6471 with the following steps:
Immediate Steps to Take
- Upgrade to the patched release closest to your current BIND version:
- BIND 9.11.8
- BIND 9.12.4-P2
- BIND 9.14.3
- BIND 9.15.1
- Consider using BIND Supported Preview Edition for eligible ISC support customers.
Long-Term Security Practices
- Regularly update BIND to the latest secure versions.
- Implement network security measures to prevent malicious queries.
Patching and Updates
Apply patches and updates provided by ISC to address the vulnerability.