title: Buffer overread in statistics channel code
description: The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.
problem types: In BIND 9.18.0 -> 9.18.6 and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, when an HTTP connection was reused to request statistics from the stats channel, the content length of successive responses could grow in size past the end of the allocated buffer.
affected:
{
vendor: ISC
product: BIND9
versions:
version: Open Source Branch 9.18 9.18.0 through versions before 9.18.7, status: affected
version: Development Branch 9.19 9.19.0 through versions before 9.19.5, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
]
exploits: This flaw was discovered in internal testing. We are not aware of any active exploits.
solutions: Upgrade to the patched release most closely related to your current version of BIND: BIND 9.18.7 or BIND 9.19.5.
workarounds: Disable the statistics channel.