Information disclosure in bind (Alpine package)

1) Information disclosure

EUVDB-ID: #VU17828

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-6465

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable. A remote attacker can request and receive a zone transfer of a DLZ even when not permitted to do so by the allow-transfer ACL.

Mitigation

Install update from vendor's website.

Vulnerable software versions

bind (Alpine package): 9.9.4-r0 - 9.12.3-r0

CPE2.3

• cpe:2.3:o:alpine:bind_alpine_package:9.12.1-r0:*:*:*:*:alpine_linux:*:
• cpe:2.3:o:alpine:bind_alpine_package:9.12.2-r0:*:*:*:*:alpine_linux:*:
• cpe:2.3:o:alpine:bind_alpine_package:9.11.1_p2-r1:*:*:*:*:alpine_linux:*:

External links

http://git.alpinelinux.org/aports/commit/?id=3e4647688661ad2aa06d7fc9a324b009c5f210af
http://git.alpinelinux.org/aports/commit/?id=3142e7931359e784a78891287108e92aefc4393c
http://git.alpinelinux.org/aports/commit/?id=d6ab6c12b91030e3c1d072ed36e093c2ebbc96cf
http://git.alpinelinux.org/aports/commit/?id=6a7a5020482526d5f8f38aa59bf9da6e245d2264
http://git.alpinelinux.org/aports/commit/?id=a72d66cd67f20dec8e4eb3d6f2b387a11a0bfbf8

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.