Description

Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended (and documented) behavior is that if an operator has not specified a value for the "allow-recursion" setting, it SHOULD default to one of the following: none, if "recursion no;" is set in named.conf; a value inherited from the "allow-query-cache" or "allow-query" settings IF "recursion yes;" (the default for that setting) AND match lists are explicitly set for "allow-query-cache" or "allow-query" (see the BIND9 Administrative Reference Manual section 6.2 for more details); or the intended default of "allow-recursion {localhost; localnets;};" if "recursion yes;" is in effect and no values are explicitly set for "allow-query-cache" or "allow-query". However, because of the regression introduced by change #4777, it is possible when "recursion yes;" is in effect and no match list values are provided for "allow-query-cache" or "allow-query" for the setting of "allow-recursion" to inherit a setting of all hosts from the "allow-query" setting default, improperly permitting recursion to all clients. Affects BIND 9.9.12, 9.10.7, 9.11.3, 9.12.0->9.12.1-P2, the development release 9.13.0, and also releases 9.9.12-S1, 9.10.7-S1, 9.11.3-S1, and 9.11.3-S2 from BIND 9 Supported Preview Edition.

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  7.5 HIGH

Vector:  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CNA:  Internet Systems Consortium (ISC)

Base Score:  5.3 MEDIUM

Vector:  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score:  5.0 MEDIUM

Vector:  (AV:N/AC:L/Au:N/C:P/I:N/A:N)

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
http://www.securitytracker.com/id/1041115	Third Party Advisory  VDB Entry
https://kb.isc.org/docs/aa-01616	Mitigation  Vendor Advisory
https://security.gentoo.org/glsa/201903-13	Third Party Advisory
https://security.netapp.com/advisory/ntap-20190830-0002/
https://usn.ubuntu.com/3683-1/	Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-200	Exposure of Sensitive Information to an Unauthorized Actor	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

7 change records found show changes

CVE Modified by Internet Systems Consortium (ISC) 5/14/2024 1:22:34 AM

Action	Type	Old Value	New Value

CVE Modified by Internet Systems Consortium (ISC) 10/09/2019 7:41:33 PM

Action	Type	Old Value	New Value
Added	CVSS V3		Internet Systems Consortium (ISC) AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE Modified by Internet Systems Consortium (ISC) 8/30/2019 1:15:11 PM

Action	Type	Old Value	New Value
Added	Reference		https://security.netapp.com/advisory/ntap-20190830-0002/ [No Types Assigned]

Modified Analysis by NIST 3/20/2019 3:16:50 PM

Action	Type	Old Value	New Value
Changed	Reference Type	https://security.gentoo.org/glsa/201903-13 No Types Assigned	https://security.gentoo.org/glsa/201903-13 Third Party Advisory

CVE Modified by Internet Systems Consortium (ISC) 3/14/2019 6:29:16 AM

Action	Type	Old Value	New Value
Added	Reference		https://security.gentoo.org/glsa/201903-13 [No Types Assigned]

Initial Analysis by NIST 2/20/2019 1:25:16 PM

Action	Type	Old Value	New Value
Added	CPE Configuration		Record truncated, showing 500 of 797 characters. View Entire Change Record OR *cpe:2.3:a:isc:bind:9.9.12:*:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.9.12:s1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.10.7:*:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.10.7:s1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.11.3:*:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.11.3:s1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.11.3:s2:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.12.0:*:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.12.0:a1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.12.0:b1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.12.0
Added	CPE Configuration		OR *cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Added	CVSS V2		(AV:N/AC:L/Au:N/C:P/I:N/A:N)
Added	CVSS V3		AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Added	CWE		CWE-200
Changed	Reference Type	http://www.securitytracker.com/id/1041115 No Types Assigned	http://www.securitytracker.com/id/1041115 Third Party Advisory, VDB Entry
Changed	Reference Type	https://kb.isc.org/docs/aa-01616 No Types Assigned	https://kb.isc.org/docs/aa-01616 Mitigation, Vendor Advisory
Changed	Reference Type	https://usn.ubuntu.com/3683-1/ No Types Assigned	https://usn.ubuntu.com/3683-1/ Third Party Advisory

CVE Modified by Internet Systems Consortium (ISC) 1/17/2019 6:29:05 AM

Action	Type	Old Value	New Value
Added	Reference		http://www.securitytracker.com/id/1041115 [No Types Assigned]
Added	Reference		https://usn.ubuntu.com/3683-1/ [No Types Assigned]