Bug 1679304 (CVE-2019-6465)
| Summary: | CVE-2019-6465 bind: Controls for zone transfers may not be properly applied to DLZs if the zones are writable | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | abhgupta, anon.amish, apmukher, chorn, dbaker, jokerman, jpopelka, mruprich, msehnout, pemensik, pzhukov, rchauhan, security-response-team, sthangav, thozza, trankin, vonsch, yozone, zdohnal |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | bind 9.11.5-P4, bind 9.12.3-P4 | Doc Type: | If docs needed, set a value |
| Doc Text: |
It was found that the controls for zone transfer were not properly applied to Dynamically Loadable Zones (DLZs). An attacker acting as a DNS client could use this flaw to request and receive a zone transfer of a DLZ even when not permitted to do so by the "allow-transfer" ACL.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-11-06 00:52:22 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1679925, 1679926, 1683009, 1683010 | ||
| Bug Blocks: | 1679305 | ||
|
Description
Pedro Sampaio
2019-02-20 20:47:40 UTC
External References: https://kb.isc.org/docs/cve-2019-6465 Created bind tracking bugs for this issue: Affects: fedora-all [bug 1679925] Created bind99 tracking bugs for this issue: Affects: fedora-all [bug 1679926] Upstream advisory notes the following versions as being affected by this issue: 9.9.0 -> 9.10.8-P1 9.11.0 -> 9.11.5-P2 9.12.0 -> 9.12.3-P2 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition 9.13.0 -> 9.13.6 of the 9.13 development branch versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465 Acknowledgments: Name: ISC Upstream commits: https://gitlab.isc.org/isc-projects/bind9/commit/34348d9ee4db15307c6c42db294419b4df569f76 https://gitlab.isc.org/isc-projects/bind9/commit/2a76f24b14eeb47d5367cc4d7e81240c6e0e2ab8 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:3552 https://access.redhat.com/errata/RHSA-2019:3552 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-6465 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:1061 https://access.redhat.com/errata/RHSA-2020:1061 |