CoreCVE
Back

HIGH

An error in the nxdomain redirect feature can cause BIND to exit with an INSIST assertion failure in query.c

Published Oct 9, 2019

Description

A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. The most likely scenario where this might occur is if the server, in addition to performing NXDOMAIN redirection for recursive clients, is also serving a local copy of the root zone or using mirroring to provide the root zone, although other configurations are also possible. Versions affected: BIND 9.12.0-> 9.12.4, 9.14.0. Also affects all releases in the 9.13 development branch.

Affected products

Remediation

Vendor solution

Upgrade to the patched release most closely related to your current version of BIND:

+ BIND 9.12.4-P1 + BIND 9.14.1

Red Hat statement

The most common bind configuration which is affected by this flaw is, if the server, in addition to performing NXDOMAIN redirection for recursive clients, is also serving a local copy of the root zone or using mirroring to provide the root zone, although other configurations are also possible.

Red Hat mitigation

Exploitation of this defect can be effectively prevented by disabling the nxdomain-redirect feature in the nameserver's configuration.

Metrics

Weaknesses (1)

CWE-617

References (6)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner isc
Published Oct 9, 2019
Updated Sep 17, 2024
Reserved Jan 16, 2019
Link CVE-2019-6467
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-6467
Red Hat
Severity Moderate
Public date Apr 24, 2019
Links CVE-2019-6467 - Bugzilla