Description
BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via certain SIG queries, which cause an assertion failure when multiple RRsets are returned.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.3.2-P1-1 | — |
| Debian 13 | bind9 | 1:9.3.2-P1-1 | — |
| Debian 12 | bind9 | 1:9.3.2-P1-1 | — |
| Debian 3.1 | bind9 | 1:9.2.4-1sarge1 | DSA-1172-1 |
Advisories 1
- DSA-1172-1 bind9 - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://docs.info.apple.com/article.html?artnum=305530
- 21835 third-party-advisory
- OpenPKG-SA-2006.019 vendor-advisory
- ADV-2007-1939 vdb-entry
- FreeBSD-SA-06:20.bind vendor-advisory
- 20060908 rPSA-2006-0166-1 bind bind-utils mailing-list
- SSRT071304 vendor-advisory
- bind-dnssec-rrset-dos(28745) vdb-entry
- http://www.niscc.gov.uk/niscc/docs/re-20060905-00590.pdf?lang=en
- SUSE-SR:2006:024 vendor-advisory
- 21786 third-party-advisory
- SUSE-SR:2006:023 vendor-advisory
- APPLE-SA-2007-05-24 vendor-advisory
- 25402 third-party-advisory
- MDKSA-2006:163 vendor-advisory
- https://issues.rpath.com/browse/RPL-626
- 21818 third-party-advisory
- USN-343-1 vendor-advisory
- 21838 third-party-advisory
- 22298 third-party-advisory
- 19859 vdb-entry
- 21816 third-party-advisory
- 21912 third-party-advisory
- 21926 third-party-advisory
- [3.9] 20060908 010: SECURITY FIX: September 8, 2006 vendor-advisory
- SSA:2006-257-01 vendor-advisory
- ADV-2006-3473 vdb-entry
- DSA-1172 vendor-advisory
- ADV-2007-1401 vdb-entry
- 21828 third-party-advisory
- VU#915404 third-party-advisory
- 21752 third-party-advisory
- 1016794 vdb-entry
- 24950 third-party-advisory
- GLSA-200609-11 vendor-advisory