Windows service and uninstall paths are not quoted when BIND is installed
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.2epss 1.4%
from disclosure to weapon0 days
Published on NVDJan 16
1st PoCJun 5
exploitation probability
1.4%top 30% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, 9.10.5-S1.
CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected products
ISC · BIND 9public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/42121unverifiedcve_referencewww.exploit-db.com/exploits/42121/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.