AI analysis
ISC BIND 9, the widely used open-source DNS server, contains a remotely triggerable denial-of-service flaw (CWE-617, reachable assertion). If the server's named.conf file lacks a global "options" block, an unauthenticated attacker can send a DNS query of QTYPE TKEY that causes an assertion failure and unexpected exit of the named daemon. The attacker gains only availability impact — the DNS server can be crashed and kept down by repeated queries — with no confidentiality or confidentiality/integrity effect (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H). Affected deployments are BIND 9.20.0 through 9.20.27, the 9.21.0 through 9.21.25 development branch, and 9.20.9-S1 through 9.20.27-S1, but only where the configuration omits a global options block. No public proof-of-concept is known, it is not in CISA KEV, and it is one of fourteen BIND 9 vulnerabilities ISC has disclosed.
What to do: Upgrade BIND 9 to a release newer than the affected boundaries (9.20.27, 9.21.25, and 9.20.27-S1) per ISC's advisory for this CVE. As an interim mitigation, ensure named.conf contains a global "options" block, since the crash is only reachable when it is absent. Admins should also review ISC's advisory covering the fourteen BIND 9 vulnerabilities disclosed together and patch accordingly.
Affected
| ISC BIND 9 | 9.20.0 through 9.20.27 |
| ISC BIND 9 | 9.21.0 through 9.21.25 (development branch) |
| ISC BIND 9 | 9.20.9-S1 through 9.20.27-S1 (stable preview branch) |
Estimated exposure
large≈10,000–100,000 internet-exposed BIND servers on the affected 9.20.x/9.21.x branches, of which only those without a global options block are vulnerable — Internet-wide port 53 scans (e.g., Shodan/Censys) show hundreds of thousands of BIND servers, but only the subset running the recent 9.20 stable/9.21 development branches — plausibly tens of thousands — falls in the affected ranges, and…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.