Description
named in BIND 8.2 through 8.2.2-P6 allows remote attackers to cause a denial of service by making a compressed zone transfer (ZXFR) request and performing a name service query on an authoritative record that is not cached, aka the "zxfr bug."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- ISC BIND 8.2.2-P5 - Denial of Service EDB-20388 · dos · Nov 1, 2000 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- RHSA-2000:107 vendor-advisory
- MDKSA-2000:067 vendor-advisory
- 20001115 Trustix Security Advisory - bind and openssh (and modutils) mailing-list
- 20001107 BIND 8.2.2-P5 Possible DOS mailing-list
- CLSA-2000:338 vendor-advisory
- CA-2000-20 third-party-advisory
- CLSA-2000:339 vendor-advisory
- bind-zxfr-dos(5540) vdb-entry
- 1923 vdb-entry
- SuSE-SA:2000:45 vendor-advisory
- 20001112 bind: remote Denial of Service vendor-advisory