CVE-2006-4095

BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via certain SIG queries, which cause an assertion failure when multiple RRsets are returned.

Weakness

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Affected Software

Name	Vendor	Start Version	End Version
Bind	Isc	*	9.2.6 (including)
Bind	Isc	9.3.0 (including)	9.3.2 (including)
Bind9	Ubuntu	dapper	*
Bind9	Ubuntu	devel	*
Bind9	Ubuntu	edgy	*
Bind9	Ubuntu	feisty	*

Extended Description

While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service. For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.

NVD	https://nvd.nist.gov/vuln/detail/CVE-2006-4095
CWE	https://cwe.mitre.org/data/definitions/617.html

Reachable Assertion

Weakness

Affected Software

Extended Description

Potential Mitigations

References