CVE-2009-0696

EXPLOITED IN THE WILD

ISC BIND 9.4-9.4.3-P2, 9.5-9.5.1-P2, 9.6-9.6.1 - Denial of Service via ANY Record in Dynamic Update

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2009-0696 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 1 public exploit from researchers including kingcope.

AI-analyzed exploit summary This is a proof-of-concept exploit for CVE-2009-0696, targeting a denial-of-service vulnerability in ISC BIND 9. It crafts a malformed Dynamic Update message to trigger a crash in the DNS server.

Description

The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message.

Exploits (1)

exploitdb WORKING POC VERIFIED
by kingcope · cdosmultiple
https://www.exploit-db.com/exploits/9300

This is a proof-of-concept exploit for CVE-2009-0696, targeting a denial-of-service vulnerability in ISC BIND 9. It crafts a malformed Dynamic Update message to trigger a crash in the DNS server.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: ISC BIND 9
No auth needed
Prerequisites: Network access to the target DNS server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (37)

Core 37
Core References
US Government Resource
http://www.kb.cert.org/vuls/id/725188
Patch, Vendor Advisory
https://www.isc.org/node/474
Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022613

Scores

EPSS 0.3330
EPSS Percentile 97.0%

Details

VulnCheck KEV 2009-07-29
InTheWild.io 2018-10-10
CWE
CWE-16
Status published
Products (8)
isc/bind 9.4
isc/bind 9.4.0 (13 CPE variants)
isc/bind 9.4.1
isc/bind 9.4.2 (3 CPE variants)
isc/bind 9.4.3 (5 CPE variants)
isc/bind 9.5
isc/bind 9.5.0 (15 CPE variants)
isc/bind 9.6 (11 CPE variants)
Published Jul 29, 2009
Tracked Since Feb 18, 2026