What’s Vulnerable › Vulnerabilities

CVE-2006-4095

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 12.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2006-09-06 · updated 2026-06-16
• Weakness: CWE-617

Description

BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via certain SIG queries, which cause an assertion failure when multiple RRsets are returned.

Affected products

• macOS: before 10.3.9; from 10.4.0 before 10.4.9 — fixed in 10.3.9, 10.4.9
• Apple Mac Os X Server: before 10.3.9; from 10.4.0 before 10.4.9 — fixed in 10.3.9, 10.4.9
• Canonical Ubuntu Linux: 5.04, 5.10, 6.06
• ISC BIND: through 9.2.6; from 9.3.0 through 9.3.2

How to fix

Upgrade to a fixed version: macOS 10.3.9, 10.4.9; Apple Mac Os X Server 10.3.9, 10.4.9. Check the vendor advisory for mitigations.

References

• http://docs.info.apple.com/article.html?artnum=305530
• http://lists.apple.com/archives/security-announce/2007/May/msg00004.html
• http://secunia.com/advisories/21752
• http://secunia.com/advisories/21786
• http://secunia.com/advisories/21816
• http://secunia.com/advisories/21818
• http://secunia.com/advisories/21828
• http://secunia.com/advisories/21835
• http://secunia.com/advisories/21838
• http://secunia.com/advisories/21912
• http://secunia.com/advisories/21926
• http://secunia.com/advisories/22298

Get alerted when CVE-2006-4095 or the next vulnerability affects your stack