CVE-2019-6465 : Controls for zone transfers may not be properly applied to Dynamically Loadable

Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465.

Published 2019-10-09 16:15:16

Updated 2019-12-16 16:57:21

Source Internet Systems Consortium (ISC)

View at NVD, CVE.org

Products affected by CVE-2019-6465

Redhat » Enterprise Linux » Version: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions
ISC » Bind
Versions from including (>=) 9.12.0 and up to, including, (<=) 9.12.2
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Matching versions
ISC » Bind
Versions from including (>=) 9.13.0 and up to, including, (<=) 9.13.6
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Matching versions
ISC » Bind
Versions from including (>=) 9.9.0 and up to, including, (<=) 9.10.7
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Matching versions
ISC » Bind
Versions from including (>=) 9.11.0 and up to, including, (<=) 9.11.4
cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Matching versions
ISC » Bind » Version: 9.9.3 Update S1
cpe:2.3:a:isc:bind:9.9.3:s1:*:*:*:*:*:*
Matching versions
ISC » Bind » Version: 9.11.5 Update P1
cpe:2.3:a:isc:bind:9.11.5:p1:*:*:*:*:*:*
Matching versions
ISC » Bind » Version: 9.12.3 Update P1
cpe:2.3:a:isc:bind:9.12.3:p1:*:*:*:*:*:*
Matching versions
ISC » Bind » Version: 9.12.3
cpe:2.3:a:isc:bind:9.12.3:-:*:*:*:*:*:*
Matching versions
ISC » Bind » Version: 9.10.8 Update P1
cpe:2.3:a:isc:bind:9.10.8:p1:*:*:*:*:*:*
Matching versions
ISC » Bind » Version: 9.11.5
cpe:2.3:a:isc:bind:9.11.5:-:*:*:*:*:*:*
Matching versions
ISC » Bind » Version: 9.11.5 Update S3 Supported Preview Edition
cpe:2.3:a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:*
Matching versions
ISC » Bind » Version: 9.10.8
cpe:2.3:a:isc:bind:9.10.8:-:*:*:*:*:*:*
Matching versions
ISC » Bind » Version: 9.11.5 Update P2
cpe:2.3:a:isc:bind:9.11.5:p2:*:*:*:*:*:*
Matching versions
ISC » Bind » Version: 9.12.3 Update P2
cpe:2.3:a:isc:bind:9.12.3:p2:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2019-6465

Top countries where our scanners detected CVE-2019-6465

Top open port discovered on systems with this issue 53

IPs affected by CVE-2019-6465 223,188

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2019-6465!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2019-6465

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-6465

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	Internet Systems Consortium (ISC)
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2019-6465

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-6465

https://kb.isc.org/docs/cve-2019-6465

CVE-2019-6465: Zone transfer controls for writable DLZ zones were not effective - Security Advisories
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3552

RHSA-2019:3552 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url