mirror of
https://github.com/0xMarcio/cve.git
synced 2025-05-06 02:31:38 +00:00
1.8 KiB
1.8 KiB
CVE-2022-0396
%2C%20and%209.18.0.%20This%20issue%20can%20only%20be%20triggered%20on%20BIND%20servers%20which%20have%20keep-response-order%20enabled%2C%20which%20is%20not%20the%20default%20configuration.%20The%20keep-response-order%20option%20is%20an%20ACL%20block%3B%20any%20hosts%20which%20are%20specified%20within%20it%20will%20be%20able%20to%20trigger%20this%20issue%20on%20affected%20versions.%20BIND%209.16.11%20-%3E%209.16.26%2C%209.17.0%20-%3E%209.18.0%20and%20versions%209.16.11-S1%20-%3E%209.16.26-S1%20of%20the%20BIND%20Supported%20Preview%20Edition.&color=brighgreen)
Description
BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection.
POC
Reference
No PoCs from references.