ISC BIND 9 TSIG Processing Vulnerability Causes Assertion Failure

A denial-of-service vulnerability has been identified in ISC BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7. When a DNS message includes a Transaction Signature (TSIG), BIND checks the TSIG's algorithm field. If the algorithm value is invalid, BIND aborts the operation, leading to an assertion failure. This vulnerability affects both authoritative and resolver servers.

Impact

Exploitation of this vulnerability causes the BIND 'named' process to terminate unexpectedly, disrupting DNS services.

Remediation

Users can upgrade to BIND 9.20.9 or 9.21.8, depending on their current version. NetApp products affected by this vulnerability should refer to the NetApp advisory NTAP-20250523-0001 for guidance.