Description
The resolver in ISC BIND 9 through 9.8.1-P1 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.8.1.dfsg.P1-4.1 | — |
| Debian 13 | bind9 | 1:9.8.1.dfsg.P1-4.1 | — |
| Debian 12 | bind9 | 1:9.8.1.dfsg.P1-4.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | bind +5 | 32:9.7.3-8.P3.el6_2.3 | RHSA-2012:0716 |
| RHEL 5 | bind +7 | 30:9.3.6-20.P1.el5_8.1 | RHSA-2012:0716 |
| RHEL 5 | bind97 +4 | 32:9.7.0-10.P2.el5_8.1 | RHSA-2012:0717 |
Advisories 2
- RHSA-2012:0716 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0717 Red Hat Security Advisory: bind97 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- HPSBUX02835 vendor-advisory
- isc-bind-update-sec-bypass(73053) vdb-entry
- https://www.isc.org/software/bind/advisories/cve-2012-1033
- 1026647 vdb-entry
- 47884 third-party-advisory
- openSUSE-SU-2012:0864 vendor-advisory
- 78916 vdb-entry
- RHSA-2012:0717 vendor-advisory
- VU#542123 third-party-advisory
- openSUSE-SU-2012:0863 vendor-advisory
- 51898 vdb-entry