Description
Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed "at the same time as requesting DNSSEC records (DO)," aka Bug 20438.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.6.1.dfsg.P2-1 | — |
| Debian 13 | bind9 | 1:9.6.1.dfsg.P2-1 | — |
| Debian 12 | bind9 | 1:9.6.1.dfsg.P2-1 | — |
| Debian 5.0 | bind9 | 1:9.5.1.dfsg.P3-1+lenny1 | DSA-1961-1 |
| Debian 4.0 | bind9 | 1:9.3.4-2etch6 | DSA-1961-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | bind +7 | 30:9.3.6-4.P1.el5_4.1 | RHSA-2009:1620 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.10.3P4-21.1 | openSUSE-SU-2024:10467-1 |
Advisories 3
- RHSA-2009:1620 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1961-1 bind9 - cache poisoning Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10467-1 bind-9.10.3P4-21.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- oval:org.mitre.oval:def:7261 vdb-entry signature
- 40730 third-party-advisory
- 37426 third-party-advisory
- http://aix.software.ibm.com/aix/efixes/security/bind9_advisory.asc
- oval:org.mitre.oval:def:10821 vdb-entry signature
- ADV-2010-0176 vdb-entry
- bind-dnssec-cache-poisoning(54416) vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=538744
- 37118 vdb-entry
- 38794 third-party-advisory
- [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates mailing-list
- 60493 vdb-entry
- https://www.isc.org/advisories/CVE-2009-4022v6
- 38240 third-party-advisory
- FEDORA-2009-12218 vendor-advisory
- 37491 third-party-advisory
- USN-888-1 vendor-advisory
- oval:org.mitre.oval:def:7459 vdb-entry signature
- [oss-security] 20091124 Re: a new bind issue mailing-list
- VU#418861 third-party-advisory
- https://www.isc.org/advisories/CVE2009-4022
- IZ71667 vendor-advisory
- 1021798 vendor-advisory
- APPLE-SA-2011-10-12-3 vendor-advisory
- 39334 third-party-advisory
- [oss-security] 20091124 CVE request: BIND 9 bug involving DNSSEC and the additional section mailing-list
- MDVSA-2009:304 vendor-advisory
- ADV-2009-3335 vdb-entry
- ADV-2010-0622 vdb-entry
- https://issues.rpath.com/browse/RPL-3152
- IZ68597 vendor-advisory
- 38834 third-party-advisory
- 38219 third-party-advisory
- oval:org.mitre.oval:def:11745 vdb-entry signature
- IZ71774 vendor-advisory
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488
- FEDORA-2009-12233 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0018
- http://support.apple.com/kb/HT5002
- RHSA-2009:1620 vendor-advisory
- [oss-security] 20091124 a new bind issue mailing-list
- 1021660 vendor-advisory
- ADV-2010-0528 vdb-entry