Vulnerability Details : CVE-2019-6477
With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).
Products affected by CVE-2019-6477
- cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.12.4:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.11.5:s6:*:*:supported_preview:*:*:*
- cpe:2.3:a:isc:bind:9.11.6:p1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.11.6:rc1:*:*:*:*:*:*
- cpe:2.3:a:isc:bind:9.11.12:s1:*:*:supported_preview:*:*:*
- cpe:2.3:a:isc:bind:9.12.4:p2:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Threat overview for CVE-2019-6477
Top countries where our scanners detected CVE-2019-6477
Top open port discovered on systems with this issue
53
IPs affected by CVE-2019-6477 3,198
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2019-6477!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2019-6477
1.71%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 87 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-6477
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST | |
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
Internet Systems Consortium (ISC) |
CWE ids for CVE-2019-6477
-
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-6477
-
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
[security-announce] openSUSE-SU-2020:1701-1: moderate: Security update f
-
https://kb.isc.org/docs/cve-2019-6477
CVE-2019-6477: TCP-pipelined queries can bypass tcp-clients limit - Security AdvisoriesThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
[security-announce] openSUSE-SU-2020:1699-1: moderate: Security update f
-
https://www.synology.com/security/advisory/Synology_SA_19_39
Synology Inc.Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3DEMNZMKR57VQJCG5ZN55ZGTQRL2TFQ/
[SECURITY] Fedora 30 Update: bind-dyndb-ldap-11.1-20.fc30 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XGURMGQHX45KR4QDRCSUQHODUFOGNGAN/
[SECURITY] Fedora 31 Update: bind-dyndb-ldap-11.2-2.fc31 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://support.f5.com/csp/article/K15840535?utm_source=f5support&utm_medium=RSS
Third Party Advisory
-
https://www.debian.org/security/2020/dsa-4689
Debian -- Security Information -- DSA-4689-1 bind9
Jump to