Description
BIND 9.7.1 and 9.7.1-P1, when a recursive validating server has a trust anchor that is configured statically or via DNSSEC Lookaside Validation (DLV), allows remote attackers to cause a denial of service (infinite loop) via a query for an RRSIG record whose answer is not in the cache, which causes BIND to repeatedly send RRSIG queries to the authoritative servers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 9.7.1.dfsg.P2 | — |
| Debian 13 | bind9 | 9.7.1.dfsg.P2 | — |
| Debian 12 | bind9 | 9.7.1.dfsg.P2 | — |
References
- SUSE-SR:2010:020 vendor-advisory
- 41730 vdb-entry
- 1024217 vdb-entry
- VU#211905 third-party-advisory
- 40709 third-party-advisory
- FEDORA-2010-11344 vendor-advisory
- 40652 third-party-advisory
- ADV-2010-1884 vdb-entry
- http://www.isc.org/software/bind/advisories/cve-2010-0213