CVE-2012-5689

What it actually does

Remote unauthenticated attacker can trigger an assertion failure in the named daemon via a crafted AAAA DNS query when DNS64 and a Response Policy Zone without an AAAA rewrite rule are configured, causing the process to exit.

Why it matters to the business

DNS resolution service becomes unavailable until the daemon is restarted, leading to outages for dependent applications and users; the vulnerability is over a decade old with stable low exploit probability and no known ransomware usage.

How an attack unfolds

An attacker sends a specially crafted DNS query requesting an AAAA record to a BIND server running a vulnerable 9.8 or 9.9 version with the specific DNS64 plus RPZ configuration; the server hits an assertion and terminates, resulting in denial of service. No named threat actors or campaigns are associated.

How to fix it

Upgrade rxvt-unicode on Debian 11/12/13 to version 9.20-1 or later; for actual ISC BIND deployments apply the vendor-supplied patches that address the assertion in the affected 9.8.4-P1 / 9.9.2-P1 releases.

How to confirm the fix worked

Confirm the installed package version meets or exceeds the stated fixed release; test that DNS64 + RPZ queries for AAAA records no longer cause named to exit.

Typical attack path

1. Identify publicly reachable BIND 9.8.x/9.9.x servers
2. Confirm presence of DNS64 and RPZ configuration lacking AAAA rewrite
3. Send crafted AAAA query that triggers the assertion
4. Observe daemon crash and loss of DNS service

How to detect it

Inspect DNS server logs for repeated AAAA queries immediately preceding named daemon crashes or restarts; correlate process termination events with inbound DNS traffic on port 53.

What your security team should do

• Apply the listed package upgrades immediately on all Debian 11/12/13 systems running the affected software
• Review DNS server configurations for DNS64 and RPZ usage and disable unnecessary features
• Monitor EPSS and KEV status for any future changes despite the age of the issue