Description
The default access control lists (ACL) in ISC BIND 9.4.0, 9.4.1, and 9.5.0a1 through 9.5.0a5 do not set the allow-recursion and allow-query-cache ACLs, which allows remote attackers to make recursive queries and query the cache.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.4.1-P1-1 | — |
| Debian 13 | bind9 | 1:9.4.1-P1-1 | — |
| Debian 12 | bind9 | 1:9.4.1-P1-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.16.20-1.4 | openSUSE-SU-2024:10650-1 |
Advisories 1
- openSUSE-SU-2024:10650-1 bind-9.16.20-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 25076 vdb-entry
- ADV-2007-2914 vdb-entry
- 1018441 vdb-entry
- ADV-2007-2628 vdb-entry
- 26509 third-party-advisory
- MDKSA-2007:149 vendor-advisory
- isc-bind-acl-security-bypass(35571) vdb-entry
- GLSA-200708-13 vendor-advisory
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=623903
- SSA:2007-207-01 vendor-advisory
- http://www.isc.org/index.pl?/sw/bind/bind-security.php
- 26227 third-party-advisory
- 26515 third-party-advisory
- 26236 third-party-advisory
- OpenPKG-SA-2007.022 vendor-advisory