Описание
For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, named does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
A flaw was found in bind. A remote attacker without a valid TSIG (Transaction Signature) can send unauthorized zone contents to a secondary server during a multi-message TCP IXFR (Incremental Zone Transfer). The named process may apply this unauthenticated data before the TSIG signature is verified. If the signature never arrives, named does not revert to its previous state, leading to the serving of unauthorized zone data and compromising information integrity.
Отчет
Moderate: This vulnerability allows an attacker to provide unauthorized zone content to a secondary BIND server if it is configured for multi-message TCP IXFR transfers with TSIG restrictions. While TSIG is intended to secure zone transfers, the flaw prevents named from rolling back changes when a valid signature is not received, leading to potential data integrity issues.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | bind | Fix deferred | ||
| Red Hat Enterprise Linux 6 | bind | Not affected | ||
| Red Hat Enterprise Linux 7 | bind | Fix deferred | ||
| Red Hat Enterprise Linux 8 | bind | Fix deferred | ||
| Red Hat Enterprise Linux 8 | bind9.16 | Fix deferred | ||
| Red Hat Enterprise Linux 9 | bind | Fix deferred | ||
| Red Hat Enterprise Linux 9 | bind9.18 | Fix deferred | ||
| Red Hat Enterprise Linux 9 | dhcp | Not affected | ||
| Red Hat Hardened Images | bind | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
(For a secondary zone with transfers restricted by TSIG, `named` may st ...)
For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
For a secondary zone with transfers restricted by TSIG, `named` may st ...
For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
6.5 Medium
CVSS3