CVE-2019-6477: TCP-pipelined queries can bypass tcp-clients limit
As per upstream advisory:
By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The update to this functionality introduced by CVE-2018-5743 changed how BIND calculates the number of concurrent TCP clients from counting the outstanding TCP queries to counting the TCP client connections. On a server with TCP-pipelining capability, it is possible for one TCP client to send a large number of DNS requests over a single connection. Each outstanding query will be handled internally as an independent client request, thus bypassing the new TCP clients limit.
Other sources
ISC BIND is vulnerable to a denial of service. By sending TCP-pipelined queries, a remote attacker could exploit this vulnerability to bypass tcp-clients limit and cause the server to consume all available resources and become unresponsive.
— IBM
With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2019-6477?
CVE-2019-6477 is a vulnerability in ISC BIND that allows a remote attacker to launch a denial-of-service attack by sending TCP-pipelined queries.
How does the vulnerability in ISC BIND work?
The vulnerability in ISC BIND occurs when pipelining is enabled, causing each incoming query on a TCP connection to consume more resources than the server can handle.
Which software and versions are affected by CVE-2019-6477?
The affected software includes bind9 (version 1:9.11.5.P4+dfsg-5.1+deb10u7 or later, 1:9.11.5.P4+dfsg-5.1+deb10u9 or later, or 1:9.16.44-1~deb11u1 or later) in Debian, IBM Data Risk Manager (version up to 2.0.6) by IBM, and various versions of bind in Debian, Red Hat, and Fedora.
How severe is CVE-2019-6477?
CVE-2019-6477 has a severity rating of 7.5 (high).
Is there a fix available for CVE-2019-6477?
Yes, patches and updates are available for the affected software. For bind9 in Debian, the official Debian repository provides the necessary patches. IBM Data Risk Manager users should apply the recommended patch provided by IBM. Red Hat and Fedora users should check the respective vendor's security advisories for available updates.