Description
named in ISC BIND 9.x before 9.6.2-P3, 9.7.x before 9.7.2-P3, 9.4-ESV before 9.4-ESV-R4, and 9.6-ESV before 9.6-ESV-R3 does not properly determine the security status of an NS RRset during a DNSKEY algorithm rollover, which might allow remote attackers to cause a denial of service (DNSSEC validation error) by triggering a rollover.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.7.2.dfsg.P3-1 | — |
| Debian 13 | bind9 | 1:9.7.2.dfsg.P3-1 | — |
| Debian 12 | bind9 | 1:9.7.2.dfsg.P3-1 | — |
| Debian 5.0 | bind9 | 1:9.6.ESV.R3+dfsg-0+lenny1 | DSA-2130-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | bind +5 | 32:9.7.0-5.P2.el6_0.1 | RHSA-2010:0975 |
| RHEL 5 | bind +7 | 30:9.3.6-4.P1.el5_5.3 | RHSA-2010:0976 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.10.3P4-21.1 | openSUSE-SU-2024:10467-1 |
Advisories 4
- RHSA-2010:0976 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0975 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2130-1 bind9 - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10467-1 bind-9.10.3P4-21.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- ADV-2010-3139 vdb-entry
- http://www.isc.org/announcement/guidance-regarding-dec-1st-2010-security-advisories
- MDVSA-2010:253 vendor-advisory
- 1024817 vdb-entry
- 42459 third-party-advisory
- [security-announce] 20110307 VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm mailing-list
- 69559 vdb-entry
- ADV-2011-0606 vdb-entry
- 45137 vdb-entry
- 20110308 VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm. mailing-list
- RHSA-2010:0975 vendor-advisory
- 42522 third-party-advisory
- ADV-2010-3103 vdb-entry
- RHSA-2010:0976 vendor-advisory
- APPLE-SA-2011-10-12-3 vendor-advisory
- VU#837744 third-party-advisory
- ADV-2010-3102 vdb-entry
- 42435 third-party-advisory
- http://www.isc.org/software/bind/advisories/cve-2010-3614
- USN-1025-1 vendor-advisory
- ADV-2010-3140 vdb-entry
- ADV-2010-3138 vdb-entry
- http://support.apple.com/kb/HT5002
- 42671 third-party-advisory
- DSA-2130 vendor-advisory
- http://support.avaya.com/css/P8/documents/100124923
- FEDORA-2010-18469 vendor-advisory
- SSA:2010-350-01 vendor-advisory
- FEDORA-2010-18521 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0004.html