Description
A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. The most likely scenario where this might occur is if the server, in addition to performing NXDOMAIN redirection for recursive clients, is also serving a local copy of the root zone or using mirroring to provide the root zone, although other configurations are also possible. Versions affected: BIND 9.12.0-> 9.12.4, 9.14.0. Also affects all releases in the 9.13 development branch.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ISC | BIND 9 | BIND 9.12.0-> 9.12.4, 9.14.0. Also affects all releases in the 9.13 development branch. | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | bind | 9.14.1-r0 | — |
| Alpine v3.23 | bind | 9.14.1-r0 | — |
| Alpine v3.22 | bind | 9.14.1-r0 | — |
| Alpine v3.21 | bind | 9.14.1-r0 | — |
| Alpine v3.20 | bind | 9.14.1-r0 | — |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | bind | 9.14.1-r0 | — |
| Alpine v3.18 | bind | 9.14.1-r0 | — |
| Alpine v3.17 | bind | 9.14.1-r0 | — |
| Alpine v3.16 | bind | 9.14.1-r0 | — |
| Alpine v3.15 | bind | 9.14.1-r0 | — |
| Alpine v3.14 | bind | 9.14.1-r0 | — |
| Alpine v3.13 | bind | 9.14.1-r0 | — |
| Alpine v3.12 | bind | 9.14.1-r0 | — |
| Alpine v3.11 | bind | 9.14.1-r0 | — |
| Alpine v3.10 | bind | 9.14.1-r0 | — |
| Alpine v3.9 | bind | 9.12.4_p1-r0 | — |
| Alpine v3.8 | bind | 9.12.4_p1-r0 | — |
| Alpine v3.7 | bind | 9.11.6_p1-r0 | — |
| Alpine v3.6 | bind | 9.11.6_p1-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
knqyf263/CVE-2019-6467 ★ 26 · Apr 25, 2019
CVE-2019-6467 (BIND nxdomain-redirect)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- WID-SEC-2025-1196 Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · May 29, 2025
- WID-SEC-2025-1195 Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · May 29, 2025