Vulnerability CVE-2019-6468

Vulnerability Name:

CVE-2019-6468 (CCN-160131)

Assigned:

2019-04-24

Published:

2019-04-24

Updated:

2019-12-18

Summary:

In BIND Supported Preview Edition, an error in the nxdomain-redirect feature can occur in versions which support EDNS Client Subnet (ECS) features. In those versions which have ECS support, enabling nxdomain-redirect is likely to lead to BIND exiting due to assertion failure. Versions affected: BIND Supported Preview Edition version 9.10.5-S1 -> 9.11.5-S5. ONLY BIND Supported Preview Edition releases are affected.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
5.2 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

5.4 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

CWE-617

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2019-6468

Source: XF
Type: UNKNOWN
isc-bind-cve20196468-dos(160131)

Source: CCN
Type: ISC Web site
CVE-2019-6468: BIND Supported Preview Edition can exit with an assertion failure if nxdomain-redirect is used

Source: CONFIRM
Type: Third Party Advisory
https://kb.isc.org/docs/cve-2019-6468

Source: CONFIRM
Type: UNKNOWN
https://www.synology.com/security/advisory/Synology_SA_19_20

Vulnerable Configuration:

Configuration 1:

cpe:/a:isc:bind:9.10.5:s1:*:*:supported_preview:*:*:*

OR cpe:/a:isc:bind:9.11.5:s5:*:*:supported_preview:*:*:*

Configuration CCN 1:

cpe:/a:isc:bind:9.10.6:*:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.10.7:*:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.11.3:*:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.11.3:s1:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.11.3:s2:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.10.7:*:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.11.3:*:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.11.4:*:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.10.8:*:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.10.8:p1:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.10.7:s1:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.11.5:s3:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.11.0:*:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.11.5:s5:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.10.5:s1:*:*:*:*:*:*

OR cpe:/a:isc:bind:9.11.5:s5:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.disco:def:201964680000000	V	CVE-2019-6468 on Ubuntu 19.04 (disco) - medium.	2019-10-09
oval:com.ubuntu.bionic:def:201964680000000	V	CVE-2019-6468 on Ubuntu 18.04 LTS (bionic) - medium.	2019-10-09
oval:com.ubuntu.xenial:def:201964680000000	V	CVE-2019-6468 on Ubuntu 16.04 LTS (xenial) - medium.	2019-10-09
oval:com.ubuntu.cosmic:def:20196468000	V	CVE-2019-6468 on Ubuntu 18.10 (cosmic) - medium.	2019-04-24
oval:com.ubuntu.cosmic:def:201964680000000	V	CVE-2019-6468 on Ubuntu 18.10 (cosmic) - medium.	2019-04-24
oval:com.ubuntu.bionic:def:20196468000	V	CVE-2019-6468 on Ubuntu 18.04 LTS (bionic) - medium.	2019-04-24
oval:com.ubuntu.xenial:def:20196468000	V	CVE-2019-6468 on Ubuntu 16.04 LTS (xenial) - medium.	2019-04-24
oval:com.ubuntu.trusty:def:20196468000	V	CVE-2019-6468 on Ubuntu 14.04 LTS (trusty) - medium.	2019-04-24

BACK