Latest BIND alert #
ISC disclosed that authoritative servers may experience assertion failures or other unexpected events when using DNSSEC-signed zones using NSEC3 in the QPzone implementation which utilizes the QPDB in-memory database. This could potentially lead to a denial-of-service. There is currently no CVE attached to this notice.
What is the impact? #
This issue affects all BIND versions from 9.20.0 to 9.20.4.
Are updates or workarounds available? #
ISC has stated they are not updating or withdrawing the 9.20 distributions. They do recommend the following either:
- Recompiling BIND 9.20 with --with-zonedb=RBTDB
- Installing the latest BIND 9.20.4 packages provided by ISC
How do I find potentially vulnerable systems with runZero? #
From the Services Inventory, use the following query to locate systems running potentially vulnerable software:
product:bind and (_service.product:="%BIND:9.20.0%" or _service.product:="%BIND:9.20.1%" or _service.product:="%BIND:9.20.3%" or _service.product:="%BIND:9.20.4%")
