CVE-2019-6471
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.2 / Impact: 3.6
Source: NVD
Description
A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1, 9.14.0 -> 9.14.2. Also all releases of the BIND 9.13 development branch and version 9.15.0 of the BIND 9.15 development branch and BIND Supported Preview Edition versions 9.11.3-S1 -> 9.11.7-S1.
Affected (109)
Products: F5: Big Ip Local Traffic Manager, Big Ip Application Acceleration Manager, Big Ip Advanced Firewall Manager, Big Ip Analytics, Big Ip Access Policy Manager, Big Ip Application Security Manager, Big Ip Edge Gateway, Big Ip Fraud Protection Service, Big Ip Global Traffic Manager, Big Ip Link Controller, Big Ip Webaccelerator, Big Ip Policy Enforcement Manager, Enterprise Manager, Big Iq Centralized Management, Iworkflow, Big Ip Domain Name System · Isc: Bind
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.5.2 to 11.5.9 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.5.2 to 11.5.9 |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.5.2 to 11.5.9 |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.5.2 to 11.5.9 |
Configuration E
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.5.2 to 11.5.9 |
Configuration F
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.5.2 to 11.5.9 |
Configuration G
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.5.2 to 11.5.9 |
Configuration H
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.5.2 to 11.5.9 |
Configuration I
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.5.2 to 11.5.9 |
Configuration J
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.5.2 to 11.5.9 |
Configuration K
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.5.2 to 11.5.9 |
Configuration L
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.5.2 to 11.5.9 |
Configuration N
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.1.1 |
Configuration O
| Vulnerable Software | Affected Versions |
|---|---|
| From 5.1.0 to 5.4.0 |
Configuration Q
| Vulnerable Software | Affected Versions |
|---|---|
| From 11.5.2 to 11.5.9 |
Related CWEs
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
CWE-617
Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
References (4)
Source: security-officer@isc.org
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Timeline
No history available yet.