Read the docs
TI-2009-00664 Aliases CVE-2009-0696GHSA-54q7-wf84-v94r

The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5…

Priority LOW 34CWE-16Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message.

Why it matters now

EPSS 0.12649 96th percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 65

CPEVersionsRoleVendor
cpe:2.3:a:isc:bind:9.4:*:*:*:*:*:*:*9.4VulnerableISC
cpe:2.3:a:isc:bind:9.4.0:*:*:*:*:*:*:*9.4.0VulnerableISC
cpe:2.3:a:isc:bind:9.4.0:a1:*:*:*:*:*:*9.4.0 a1VulnerableISC
cpe:2.3:a:isc:bind:9.4.0:a2:*:*:*:*:*:*9.4.0 a2VulnerableISC
cpe:2.3:a:isc:bind:9.4.0:a3:*:*:*:*:*:*9.4.0 a3VulnerableISC
cpe:2.3:a:isc:bind:9.4.0:a4:*:*:*:*:*:*9.4.0 a4VulnerableISC
cpe:2.3:a:isc:bind:9.4.0:a5:*:*:*:*:*:*9.4.0 a5VulnerableISC
cpe:2.3:a:isc:bind:9.4.0:a6:*:*:*:*:*:*9.4.0 a6VulnerableISC
cpe:2.3:a:isc:bind:9.4.0:b1:*:*:*:*:*:*9.4.0 b1VulnerableISC
cpe:2.3:a:isc:bind:9.4.0:b2:*:*:*:*:*:*9.4.0 b2VulnerableISC
  • cpe:2.3:a:isc:bind:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.0:*:*:*:*:*:*:* Versions 9.4.0 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.0:a1:*:*:*:*:*:* Versions 9.4.0 a1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.0:a2:*:*:*:*:*:* Versions 9.4.0 a2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.0:a3:*:*:*:*:*:* Versions 9.4.0 a3 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.0:a4:*:*:*:*:*:* Versions 9.4.0 a4 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.0:a5:*:*:*:*:*:* Versions 9.4.0 a5 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.0:a6:*:*:*:*:*:* Versions 9.4.0 a6 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.0:b1:*:*:*:*:*:* Versions 9.4.0 b1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.0:b2:*:*:*:*:*:* Versions 9.4.0 b2 Vulnerable ·ISC
Show 55 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:isc:bind:9.4.0:b3:*:*:*:*:*:*9.4.0 b3VulnerableISC
cpe:2.3:a:isc:bind:9.4.0:b4:*:*:*:*:*:*9.4.0 b4VulnerableISC
cpe:2.3:a:isc:bind:9.4.0:rc1:*:*:*:*:*:*9.4.0 rc1VulnerableISC
cpe:2.3:a:isc:bind:9.4.0:rc2:*:*:*:*:*:*9.4.0 rc2VulnerableISC
cpe:2.3:a:isc:bind:9.4.1:*:*:*:*:*:*:*9.4.1VulnerableISC
cpe:2.3:a:isc:bind:9.4.2:*:*:*:*:*:*:*9.4.2VulnerableISC
cpe:2.3:a:isc:bind:9.4.2:rc1:*:*:*:*:*:*9.4.2 rc1VulnerableISC
cpe:2.3:a:isc:bind:9.4.2:rc2:*:*:*:*:*:*9.4.2 rc2VulnerableISC
cpe:2.3:a:isc:bind:9.4.3:*:*:*:*:*:*:*9.4.3VulnerableISC
cpe:2.3:a:isc:bind:9.4.3:b1:*:*:*:*:*:*9.4.3 b1VulnerableISC
cpe:2.3:a:isc:bind:9.4.3:b2:*:*:*:*:*:*9.4.3 b2VulnerableISC
cpe:2.3:a:isc:bind:9.4.3:b3:*:*:*:*:*:*9.4.3 b3VulnerableISC
cpe:2.3:a:isc:bind:9.4.3:p2:*:*:*:*:*:*9.4.3 p2VulnerableISC
cpe:2.3:a:isc:bind:9.5:*:*:*:*:*:*:*9.5VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:*:*:*:*:*:*:*9.5.0VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:a1:*:*:*:*:*:*9.5.0 a1VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:a2:*:*:*:*:*:*9.5.0 a2VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:a3:*:*:*:*:*:*9.5.0 a3VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:a4:*:*:*:*:*:*9.5.0 a4VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:a5:*:*:*:*:*:*9.5.0 a5VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:a6:*:*:*:*:*:*9.5.0 a6VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:a7:*:*:*:*:*:*9.5.0 a7VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:b1:*:*:*:*:*:*9.5.0 b1VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:b2:*:*:*:*:*:*9.5.0 b2VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:b3:*:*:*:*:*:*9.5.0 b3VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:p1:*:*:*:*:*:*9.5.0 p1VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:p2:*:*:*:*:*:*9.5.0 p2VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:p2_w1:*:*:*:*:*:*9.5.0 p2_w1VulnerableISC
cpe:2.3:a:isc:bind:9.5.0:p2_w2:*:*:*:*:*:*9.5.0 p2_w2VulnerableISC
cpe:2.3:a:isc:bind:9.6:*:*:*:esv:*:*:*9.6VulnerableISC
cpe:2.3:a:isc:bind:9.6:r1:*:*:esv:*:*:*9.6 r1VulnerableISC
cpe:2.3:a:isc:bind:9.6:r2:*:*:esv:*:*:*9.6 r2VulnerableISC
cpe:2.3:a:isc:bind:9.6:r3:*:*:esv:*:*:*9.6 r3VulnerableISC
cpe:2.3:a:isc:bind:9.6:r4:*:*:esv:*:*:*9.6 r4VulnerableISC
cpe:2.3:a:isc:bind:9.6:r4_p1:*:*:esv:*:*:*9.6 r4_p1VulnerableISC
cpe:2.3:a:isc:bind:9.6:r5:*:*:esv:*:*:*9.6 r5VulnerableISC
cpe:2.3:a:isc:bind:9.6:r5_b1:*:*:esv:*:*:*9.6 r5_b1VulnerableISC
cpe:2.3:a:isc:bind:9.6:r5_p1:*:*:esv:*:*:*9.6 r5_p1VulnerableISC
cpe:2.3:a:isc:bind:9.6:r6:*:*:esv:*:*:*9.6 r6VulnerableISC
cpe:2.3:a:isc:bind:9.6:r6_b1:*:*:esv:*:*:*9.6 r6_b1VulnerableISC
cpe:2.3:a:isc:bind:9.6:r6_rc1:*:*:esv:*:*:*9.6 r6_rc1VulnerableISC
cpe:2.3:a:isc:bind:9.6:r6_rc2:*:*:esv:*:*:*9.6 r6_rc2VulnerableISC
cpe:2.3:a:isc:bind:9.6:r7:*:*:esv:*:*:*9.6 r7VulnerableISC
cpe:2.3:a:isc:bind:9.6:r7_p1:*:*:esv:*:*:*9.6 r7_p1VulnerableISC
cpe:2.3:a:isc:bind:9.6:r7_p2:*:*:esv:*:*:*9.6 r7_p2VulnerableISC
cpe:2.3:a:isc:bind:9.6:r9:*:*:esv:*:*:*9.6 r9VulnerableISC
cpe:2.3:a:isc:bind:9.6:r9_p1:*:*:esv:*:*:*9.6 r9_p1VulnerableISC
cpe:2.3:a:isc:bind:9.6.0:*:*:*:*:*:*:*9.6.0VulnerableISC
cpe:2.3:a:isc:bind:9.6.0:a1:*:*:*:*:*:*9.6.0 a1VulnerableISC
cpe:2.3:a:isc:bind:9.6.0:b1:*:*:*:*:*:*9.6.0 b1VulnerableISC
cpe:2.3:a:isc:bind:9.6.0:p1:*:*:*:*:*:*9.6.0 p1VulnerableISC
cpe:2.3:a:isc:bind:9.6.0:rc1:*:*:*:*:*:*9.6.0 rc1VulnerableISC
cpe:2.3:a:isc:bind:9.6.0:rc2:*:*:*:*:*:*9.6.0 rc2VulnerableISC
cpe:2.3:a:isc:bind:9.6.1:*:*:*:*:*:*:*9.6.1VulnerableISC
cpe:2.3:a:isc:bind:9.6.1:b1:*:*:*:*:*:*9.6.1 b1VulnerableISC
  • cpe:2.3:a:isc:bind:9.4.0:b3:*:*:*:*:*:* Versions 9.4.0 b3 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.0:b4:*:*:*:*:*:* Versions 9.4.0 b4 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.0:rc1:*:*:*:*:*:* Versions 9.4.0 rc1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.0:rc2:*:*:*:*:*:* Versions 9.4.0 rc2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.1:*:*:*:*:*:*:* Versions 9.4.1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.2:*:*:*:*:*:*:* Versions 9.4.2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.2:rc1:*:*:*:*:*:* Versions 9.4.2 rc1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.2:rc2:*:*:*:*:*:* Versions 9.4.2 rc2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.3:*:*:*:*:*:*:* Versions 9.4.3 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.3:b1:*:*:*:*:*:* Versions 9.4.3 b1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.3:b2:*:*:*:*:*:* Versions 9.4.3 b2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.3:b3:*:*:*:*:*:* Versions 9.4.3 b3 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.4.3:p2:*:*:*:*:*:* Versions 9.4.3 p2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5:*:*:*:*:*:*:* Versions 9.5 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:*:*:*:*:*:*:* Versions 9.5.0 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:a1:*:*:*:*:*:* Versions 9.5.0 a1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:a2:*:*:*:*:*:* Versions 9.5.0 a2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:a3:*:*:*:*:*:* Versions 9.5.0 a3 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:a4:*:*:*:*:*:* Versions 9.5.0 a4 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:a5:*:*:*:*:*:* Versions 9.5.0 a5 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:a6:*:*:*:*:*:* Versions 9.5.0 a6 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:a7:*:*:*:*:*:* Versions 9.5.0 a7 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:b1:*:*:*:*:*:* Versions 9.5.0 b1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:b2:*:*:*:*:*:* Versions 9.5.0 b2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:b3:*:*:*:*:*:* Versions 9.5.0 b3 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:p1:*:*:*:*:*:* Versions 9.5.0 p1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:p2:*:*:*:*:*:* Versions 9.5.0 p2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:p2_w1:*:*:*:*:*:* Versions 9.5.0 p2_w1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.5.0:p2_w2:*:*:*:*:*:* Versions 9.5.0 p2_w2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:*:*:*:esv:*:*:* Versions 9.6 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r1:*:*:esv:*:*:* Versions 9.6 r1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r2:*:*:esv:*:*:* Versions 9.6 r2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r3:*:*:esv:*:*:* Versions 9.6 r3 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r4:*:*:esv:*:*:* Versions 9.6 r4 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r4_p1:*:*:esv:*:*:* Versions 9.6 r4_p1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r5:*:*:esv:*:*:* Versions 9.6 r5 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r5_b1:*:*:esv:*:*:* Versions 9.6 r5_b1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r5_p1:*:*:esv:*:*:* Versions 9.6 r5_p1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r6:*:*:esv:*:*:* Versions 9.6 r6 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r6_b1:*:*:esv:*:*:* Versions 9.6 r6_b1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r6_rc1:*:*:esv:*:*:* Versions 9.6 r6_rc1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r6_rc2:*:*:esv:*:*:* Versions 9.6 r6_rc2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r7:*:*:esv:*:*:* Versions 9.6 r7 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r7_p1:*:*:esv:*:*:* Versions 9.6 r7_p1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r7_p2:*:*:esv:*:*:* Versions 9.6 r7_p2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r9:*:*:esv:*:*:* Versions 9.6 r9 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6:r9_p1:*:*:esv:*:*:* Versions 9.6 r9_p1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6.0:*:*:*:*:*:*:* Versions 9.6.0 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6.0:a1:*:*:*:*:*:* Versions 9.6.0 a1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6.0:b1:*:*:*:*:*:* Versions 9.6.0 b1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6.0:p1:*:*:*:*:*:* Versions 9.6.0 p1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6.0:rc1:*:*:*:*:*:* Versions 9.6.0 rc1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6.0:rc2:*:*:*:*:*:* Versions 9.6.0 rc2 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6.1:*:*:*:*:*:*:* Versions 9.6.1 Vulnerable ·ISC
  • cpe:2.3:a:isc:bind:9.6.1:b1:*:*:*:*:*:* Versions 9.6.1 b1 Vulnerable ·ISC

Remediation

Red Hat 3 advisories

  • RHSA-2009:1181 Released 2009-07-29 · Red Hat rating Important
    bind security and bug fix update
    • Red Hat Desktop version 3 bind-20:9.2.4-25.el3, bind-20:9.2.4-25.el3.i386, bind-chroot-20:9.2.4-25.el3 +7
    • Red Hat Enterprise Linux AS version 3 bind-20:9.2.4-25.el3, bind-20:9.2.4-25.el3.i386, bind-20:9.2.4-25.el3.ia64 +17
    • Red Hat Enterprise Linux ES version 3 bind-20:9.2.4-25.el3, bind-20:9.2.4-25.el3.i386, bind-20:9.2.4-25.el3.ia64 +12
    • Red Hat Enterprise Linux WS version 3 bind-20:9.2.4-25.el3, bind-20:9.2.4-25.el3.i386, bind-20:9.2.4-25.el3.ia64 +12
  • RHSA-2009:1180 Released 2009-07-29 · Red Hat rating Important
    bind security and bug fix update
    • Red Hat Enterprise Linux AS version 4 bind-20:9.2.4-30.el4_8.4, bind-20:9.2.4-30.el4_8.4.i386, bind-20:9.2.4-30.el4_8.4.ia64 +17
    • Red Hat Enterprise Linux Desktop version 4 bind-20:9.2.4-30.el4_8.4, bind-20:9.2.4-30.el4_8.4.i386, bind-chroot-20:9.2.4-30.el4_8.4 +7
    • Red Hat Enterprise Linux ES version 4 bind-20:9.2.4-30.el4_8.4, bind-20:9.2.4-30.el4_8.4.i386, bind-20:9.2.4-30.el4_8.4.ia64 +12
    • Red Hat Enterprise Linux WS version 4 bind-20:9.2.4-30.el4_8.4, bind-20:9.2.4-30.el4_8.4.i386, bind-20:9.2.4-30.el4_8.4.ia64 +12
  • RHSA-2009:1179 Released 2009-07-29 · Red Hat rating Important
    bind security update
    • Red Hat Enterprise Linux (v. 5 server) bind-30:9.3.4-10.P1.el5_3.3, bind-30:9.3.4-10.P1.el5_3.3.i386, bind-30:9.3.4-10.P1.el5_3.3.ia64 +29
    • Red Hat Enterprise Linux Desktop (v. 5 client) bind-30:9.3.4-10.P1.el5_3.3, bind-30:9.3.4-10.P1.el5_3.3.i386, bind-libs-30:9.3.4-10.P1.el5_3.3 +5
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) bind-30:9.3.4-10.P1.el5_3.3, bind-chroot-30:9.3.4-10.P1.el5_3.3, bind-chroot-30:9.3.4-10.P1.el5_3.3.i386 +6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 3Fixed RHSA-2009:1181
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:1179
Red Hat Enterprise Linux AS version 3Fixed RHSA-2009:1181
Red Hat Enterprise Linux AS version 4Fixed RHSA-2009:1180
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:1179
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2009:1179
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2009:1180
Red Hat Enterprise Linux ES version 3Fixed RHSA-2009:1181
Red Hat Enterprise Linux ES version 4Fixed RHSA-2009:1180
Red Hat Enterprise Linux WS version 3Fixed RHSA-2009:1181
Red Hat Enterprise Linux WS version 4Fixed RHSA-2009:1180

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-0696
  2. 2026-10-03 Alias added: GHSA-54q7-wf84-v94r

References

Patch 1

Other 20

  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2023-27571 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related… CVSS 3.1HIGH 7.5
  • TI-2021-07476 A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack CVSS 3.1CRITICAL 9.8
  • TI-2023-27773 The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance… CVSS 3.1HIGH 7.5
  • TI-2020-06910 A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c CVSS 3.1HIGH 7.5
  • TI-2016-02320 buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x… CVSS 3.0HIGH 7.5
See all 192 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences