cvelist/2019/6xxx/CVE-2019-6476.json

{
    "CVE_data_meta": {
        "ASSIGNER": "security-officer@isc.org",
        "DATE_PUBLIC": "2019-10-16T17:36:53.000Z",
        "ID": "CVE-2019-6476",
        "STATE": "PUBLIC",
        "TITLE": "An error in QNAME minimization code can cause BIND to exit with an assertion failure"
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "ISC",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "BIND 9",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_value": "9.14.0 up to 9.14.6"
                                        },
                                        {
                                            "version_value": "9.15.0 up to 9.15.4"
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "data_format": "MITRE",
    "data_type": "CVE",
    "data_version": "4.0",
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4."
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.0.8"
    },
    "impact": {
        "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
        }
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "An attacker who manages to deliberately trigger this condition on a server which is performing recursion can cause named to exit, denying service to clients."
                    }
                ]
            }
        ]
    },
    "references": {
        "reference_data": [
            {
                "name": "https://kb.isc.org/docs/cve-2019-6476",
                "refsource": "CONFIRM",
                "url": "https://kb.isc.org/docs/cve-2019-6476"
            },
            {
                "refsource": "CONFIRM",
                "name": "https://security.netapp.com/advisory/ntap-20191024-0004/",
                "url": "https://security.netapp.com/advisory/ntap-20191024-0004/"
            },
            {
                "refsource": "CONFIRM",
                "name": "https://support.f5.com/csp/article/K42238532?utm_source=f5support&utm_medium=RSS",
                "url": "https://support.f5.com/csp/article/K42238532?utm_source=f5support&utm_medium=RSS"
            }
        ]
    },
    "solution": [
        {
            "lang": "eng",
            "value": "Upgrade to the patched release most closely related to your current version of BIND:\n   +  BIND 9.14.7\n   +  BIND 9.15.5\n"
        }
    ],
    "source": {
        "discovery": "USER"
    },
    "work_around": [
        {
            "lang": "eng",
            "value": "ervers which have QNAME minimization turned on are potentially vulnerable to this defect if they are running an affected version of BIND. The vulnerability can be avoided by disabling QNAME minimization using \"qname-minimization disabled;\" in the global options section of named.conf (Note: the default value for the qname-minimization setting in the 9.14 and 9.15 branches is \"relaxed\". To make use of this workaround it must be explicitly disabled.)"
        }
    ]
}