Debian Long Term Support / LTS Security Information / 2021 / Security Information -- DLA-2807-1 bind9

Debian Security Advisory

DLA-2807-1 bind9 -- LTS security update

Date Reported:

02 Nov 2021

Affected Packages:

bind9

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 905743.
In Mitre's CVE dictionary: CVE-2018-5740, CVE-2021-25219.

More information:

• CVE-2021-25219

  Kishore Kumar Kothapalli discovered that the lame server cache in BIND, a DNS server implementation, can be abused by an attacker to significantly degrade resolver performance, resulting in denial of service (large delays for responses for client queries and DNS timeouts on client hosts).

• CVE-2018-5740

  "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c.

For Debian 9 stretch, these problems have been fixed in version 1:9.10.3.dfsg.P4-12.3+deb9u10.

We recommend that you upgrade your bind9 packages.

For the detailed security status of bind9 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/bind9

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS