Description
named in ISC BIND 9.7.2-P2 does not check all intended locations for allow-query ACLs, which might allow remote attackers to make successful requests for private DNS records via the standard DNS query mechanism.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.7.2.dfsg.P3-1 | — |
| Debian 13 | bind9 | 1:9.7.2.dfsg.P3-1 | — |
| Debian 12 | bind9 | 1:9.7.2.dfsg.P3-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.10.3P4-21.1 | openSUSE-SU-2024:10467-1 |
Advisories 1
- openSUSE-SU-2024:10467-1 bind-9.10.3P4-21.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 69568 vdb-entry
- http://www.isc.org/announcement/guidance-regarding-dec-1st-2010-security-advisories
- 1024817 vdb-entry
- http://www.isc.org/software/bind/advisories/cve-2010-3615
- 42458 third-party-advisory
- 45134 vdb-entry
- ADV-2010-3102 vdb-entry
- 42671 third-party-advisory
- VU#510208 third-party-advisory
- FEDORA-2010-18469 vendor-advisory
- SSA:2010-350-01 vendor-advisory