Description
ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.8.4.dfsg.P1-6+nmu1 | — |
| Debian 13 | bind9 | 1:9.8.4.dfsg.P1-6+nmu1 | — |
| Debian 12 | bind9 | 1:9.8.4.dfsg.P1-6+nmu1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | bind9 | 1:9.9.5.dfsg-3ubuntu0.4 | USN-2693-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | bind +5 | 32:9.8.2-0.17.rc1.el6.3 | RHSA-2013:0550 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.10.3P4-21.1 | openSUSE-SU-2024:10467-1 |
Advisories 4
- USN-2693-1 bind9 vulnerabilities Ubuntu Security Notices (USN) · Oct 12, 2026
- RHSA-2013:0550 Red Hat Security Advisory: bind security and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10467-1 bind-9.10.3P4-21.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1174 Internet Systems Consortium BIND: Schwachstelle ermöglicht Denial Of Service BSI CERT-Bund (WID) · May 29, 2025
References
- https://kb.isc.org/article/AA-00855/
- http://www.isc.org/software/bind/advisories/cve-2012-5689
- USN-2693-1 vendor-advisory
- RHSA-2013:0550 vendor-advisory