5.3
MEDIUM
CVE-2019-6465
BIND Zone Transfer Configuration Vulnerability
Description

Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465.

INFO

Published Date :

Oct. 9, 2019, 4:15 p.m.

Last Modified :

Dec. 16, 2019, 4:57 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

1.4

Exploitability Score :

3.9
Public PoC/Exploit Available at Github

CVE-2019-6465 has a 7 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2019-6465 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Redhat enterprise_linux
1 Isc bind
: Total Affected Vendor : 2 | Products : 2
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2019-6465.

URL Resource
https://access.redhat.com/errata/RHSA-2019:3552 Third Party Advisory
https://kb.isc.org/docs/cve-2019-6465 Third Party Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
psmedley/bind-os2

None

Emacs Lisp Makefile C Shell Roff HTML C++ XSLT Perl Python

Updated: 2 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : July 6, 2024, 9:22 a.m. This repo has been linked 35 different CVEs too.
Profile Photo
fokypoky/places-list

None

asp-net-core csharp docker dockerfile javascript react webapi docker-compose

C# Dockerfile HTML JavaScript CSS

Updated: 5 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Feb. 22, 2024, 6:42 p.m. This repo has been linked 383 different CVEs too.
Profile Photo
balabit-deps/balabit-os-9-bind9-libs

None

Emacs Lisp Makefile C Shell Roff HTML C++ XSLT Perl Python

Updated: 1 year, 10 months ago
0 stars 0 fork 0 watcher
Born at : Nov. 15, 2022, 10:19 a.m. This repo has been linked 25 different CVEs too.
Profile Photo
balabit-deps/balabit-os-8-bind9-libs

None

Emacs Lisp Makefile C Shell Roff HTML C++ XSLT Perl Python

Updated: 1 year, 10 months ago
0 stars 0 fork 0 watcher
Born at : Nov. 11, 2022, 1:15 p.m. This repo has been linked 23 different CVEs too.
Profile Photo
vincent-deng/veracode-container-security-finding-parser

Map Vulnerabilities into Different Layers of the Container Image

Python

Updated: 1 year, 8 months ago
1 stars 0 fork 0 watcher
Born at : Oct. 5, 2022, 12:07 p.m. This repo has been linked 1276 different CVEs too.
Profile Photo
pexip/os-bind9-libs

Packaging for bind9-libs

Emacs Lisp Makefile C Shell Roff HTML C++ XSLT Perl Python

Updated: 4 months ago
0 stars 0 fork 0 watcher
Born at : June 21, 2022, 1:57 p.m. This repo has been linked 25 different CVEs too.
Profile Photo
HJXSaber/bind9-my

None

Makefile C Shell Roff HTML C++ XSLT Perl Python Batchfile

Updated: 5 years, 5 months ago
0 stars 0 fork 0 watcher
Born at : April 13, 2019, 7:07 a.m. This repo has been linked 7 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2019-6465 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2019-6465 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • Modified Analysis by [email protected]

    Dec. 16, 2019

    Action Type Old Value New Value
    Changed Reference Type https://access.redhat.com/errata/RHSA-2019:3552 No Types Assigned https://access.redhat.com/errata/RHSA-2019:3552 Third Party Advisory
    Changed CPE Configuration OR *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from (including) 9.9.0 up to (including) 9.10.7 *cpe:2.3:a:isc:bind:9.9.3:s1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.10.8:-:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.10.8:p1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from (including) 9.11.0 up to (including) 9.11.4 *cpe:2.3:a:isc:bind:9.11.5:-:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.11.5:p1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.11.5:p2:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:* *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from (including) 9.12.0 up to (including) 9.12.2 *cpe:2.3:a:isc:bind:9.12.3:p1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.12.3:p2:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.12.3.-:*:*:*:*:*:*:* *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from (including) 9.13.0 up to (including) 9.13.6 OR *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from (including) 9.9.0 up to (including) 9.10.7 *cpe:2.3:a:isc:bind:9.9.3:s1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.10.8:-:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.10.8:p1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from (including) 9.11.0 up to (including) 9.11.4 *cpe:2.3:a:isc:bind:9.11.5:-:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.11.5:p1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.11.5:p2:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:* *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from (including) 9.12.0 up to (including) 9.12.2 *cpe:2.3:a:isc:bind:9.12.3:-:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.12.3:p1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.12.3:p2:*:*:*:*:*:* *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from (including) 9.13.0 up to (including) 9.13.6
    Added CPE Configuration OR *cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Nov. 06, 2019

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2019:3552 [No Types Assigned]
  • Initial Analysis by [email protected]

    Nov. 01, 2019

    Action Type Old Value New Value
    Added CVSS V2 NIST (AV:N/AC:M/Au:N/C:P/I:N/A:N)
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    Changed Reference Type https://kb.isc.org/docs/cve-2019-6465 No Types Assigned https://kb.isc.org/docs/cve-2019-6465 Third Party Advisory
    Added CWE NIST CWE-732
    Added CPE Configuration OR *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from (including) 9.9.0 up to (including) 9.10.7 *cpe:2.3:a:isc:bind:9.9.3:s1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.10.8:-:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.10.8:p1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from (including) 9.11.0 up to (including) 9.11.4 *cpe:2.3:a:isc:bind:9.11.5:-:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.11.5:p1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.11.5:p2:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:* *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from (including) 9.12.0 up to (including) 9.12.2 *cpe:2.3:a:isc:bind:9.12.3:p1:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.12.3:p2:*:*:*:*:*:* *cpe:2.3:a:isc:bind:9.12.3.-:*:*:*:*:*:*:* *cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:* versions from (including) 9.13.0 up to (including) 9.13.6
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.07 }} -0.00%

score

0.30909

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: