Description
ISC BIND before 9.7.2-P2, when DNSSEC validation is enabled, does not properly handle certain bad signatures if multiple trust anchors exist for a single zone, which allows remote attackers to cause a denial of service (daemon crash) via a DNS query.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.7.2.dfsg.P2-1 | — |
| Debian 13 | bind9 | 1:9.7.2.dfsg.P2-1 | — |
| Debian 12 | bind9 | 1:9.7.2.dfsg.P2-1 | — |
| Debian 5.0 | bind9 | 1:9.6.ESV.R3+dfsg-0+lenny1 | DSA-2130-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | bind +7 | 30:9.3.6-4.P1.el5_5.3 | RHSA-2010:0976 |
Advisories 2
- RHSA-2010:0976 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2130-1 bind9 - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDVSA-2010:253 vendor-advisory
- [security-announce] 20110307 VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm mailing-list
- ADV-2011-0606 vdb-entry
- 20110308 VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm. mailing-list
- http://ftp.isc.org/isc/bind9/9.7.2-P2/RELEASE-NOTES-BIND-9.7.2-P2.html
- RHSA-2010:0976 vendor-advisory
- DSA-2130 vendor-advisory
- http://support.avaya.com/css/P8/documents/100124923
- 45385 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2011-0004.html