title: update-policy rules of type "subdomain" are enforced incorrectly
description: In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.
problem types: Change 4885 inadvertently caused "update-policy" rules of type "subdomain" to be treated as if they were of type "zonesub", allowing updates to all parts of the zone along with the intended subdomain.  Affects BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition
affected:
{
product: BIND9
vendor: ISC
versions:
lessThan: unspecified, status: affected, version: 9.9.12, versionType: custom
lessThanOrEqual: 9.9.13, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 9.10.7, versionType: custom
lessThanOrEqual: 9.10.8, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 9.11.3, versionType: custom
lessThan: 9.11.22, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 9.12.1, versionType: custom
lessThan: 9.16.6, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 9.17.0, versionType: custom
lessThan: 9.17.4, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 9.9.12-S1, versionType: custom
lessThanOrEqual: 9.9.13-S1, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 9.11.3-S1, versionType: custom
lessThan: 9.11.22-S1, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
]
exploits: We are not aware of any active exploits but the issue has been described on a public bug tracker for a Linux distribution.
solutions: Upgrade to the patched release most closely related to your current version of BIND:
BIND 9.11.22
BIND 9.16.6
BIND 9.17.4
BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.
BIND 9.11.22-S1
workarounds: No workarounds known.