CVE-2006-4096

Description

BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via a flood of recursive queries, which cause an INSIST failure when the response is received after the recursion queue is empty.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 24.50% Top 5%

Vendor Advisory openpkg.com Vendor Advisory freebsd.org Vendor Advisory marc.info Vendor Advisory hp.com Vendor Advisory novell.com Vendor Advisory ibm.com Vendor Advisory novell.com Vendor Advisory apple.com Vendor Advisory mandriva.com Vendor Advisory ubuntu.com Vendor Advisory ibm.com Vendor Advisory openbsd.org Vendor Advisory slackware.com Vendor Advisory debian.org Vendor Advisory gentoo.org

Affected: n/a n/a

References

Link	Tags
http://docs.info.apple.com/article.html?artnum=305530
http://secunia.com/advisories/21835	third party advisory
http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.019.html	vendor advisory
http://www.vupen.com/english/advisories/2007/1939	vdb entry
http://security.freebsd.org/advisories/FreeBSD-SA-06:20.bind.asc	vendor advisory
http://marc.info/?l=bugtraq&m=141879471518471&w=2	vendor advisory
http://www.securityfocus.com/archive/1/445600/100/0/threaded	mailing list
https://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144	vendor advisory
http://www.niscc.gov.uk/niscc/docs/re-20060905-00590.pdf?lang=en	patch
http://www.novell.com/linux/security/advisories/2006_24_sr.html	vendor advisory
http://secunia.com/advisories/21786	third party advisory
http://www-1.ibm.com/support/docview.wss?uid=isg1IY89178	vendor advisory
http://www.novell.com/linux/security/advisories/2006_23_sr.html	vendor advisory
http://lists.apple.com/archives/security-announce/2007/May/msg00004.html	vendor advisory
http://secunia.com/advisories/25402	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:163	vendor advisory
https://issues.rpath.com/browse/RPL-626
http://secunia.com/advisories/21818	third party advisory
http://www.ubuntu.com/usn/usn-343-1	vendor advisory
http://secunia.com/advisories/21838	third party advisory
http://secunia.com/advisories/22298	third party advisory
http://www.securityfocus.com/bid/19859	vdb entry
http://secunia.com/advisories/21816	third party advisory
http://www-1.ibm.com/support/docview.wss?uid=isg1IY89169	vendor advisory
http://secunia.com/advisories/21912	third party advisory
http://secunia.com/advisories/21926	third party advisory
http://secunia.com/advisories/21790	third party advisory
http://www.openbsd.org/errata.html	vendor advisory
http://www.vupen.com/english/advisories/2006/3511	vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9623	signature vdb entry
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.481241	vendor advisory
http://www.vupen.com/english/advisories/2006/3473	vdb entry
http://www.kb.cert.org/vuls/id/697164	patch third party advisory us government resource
http://www.us.debian.org/security/2006/dsa-1172	vendor advisory
http://www.vupen.com/english/advisories/2007/1401	vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/28744	vdb entry
http://secunia.com/advisories/21828	third party advisory
http://secunia.com/advisories/21752	third party advisory
http://securitytracker.com/id?1016794	vdb entry
http://secunia.com/advisories/24950	third party advisory
http://security.gentoo.org/glsa/glsa-200609-11.xml	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2006-4096?: CVE-2006-4096 has been scored as a medium severity vulnerability.
How to fix CVE-2006-4096?: To fix CVE-2006-4096, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-4096 being actively exploited in the wild?: It is possible that CVE-2006-4096 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~25% probability that this vulnerability will be exploited by malicious actors in the next 30 days.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.