CVSS: 7.8EPSS: 33%CPEs: 278EXPL: 0CVE-2012-4244 – bind: specially crafted resource record causes named to exit
https://notcve.org/view.php?id=CVE-2012-4244
ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P3 allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a long resource record. ISC BIND v9.x antes de v9.7.6-P3, v9.8.x antes de v9.8.3-P3, v9.9.x antes de v9.9.1-P3, y v9.4-ESV y v9.6-ESV antes de v9.6-ESV-R7-P3 permite provocar una denegación de servicio (error de aserción y salida de demonio) a atacantes remotos a través de una consulta para un registro de recursos demasiado largo. • http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087697.html http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087703.html http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088381.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00022.html http://lists.opensuse.org/opensuse-security& •
CVSS: 7.8EPSS: 6%CPEs: 94EXPL: 0CVE-2012-3817 – bind: heavy DNSSEC validation load can cause assertion failure
https://notcve.org/view.php?id=CVE-2012-3817
ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) by sending many queries. ISC BIND v9.4.x, v9.5.x, v9.6.x, v9.7.x, y antes de v9.7.6-P2; v9.8.x antes de v9.8.3-P2; v9.9.x antes de v9.9.1-P2, y v9.6-ESV antes v9.6-ESV-vR7-P2, cuando está habilitada la validación DNSSEC, no inicializar correctamente la caché no-query, que permite a atacantes remotos provocar una denegación de servicio (error de aserción y salida demonio) mediante el envío de muchas consultas. • http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html http://lists.opensuse.org/opensuse-updates/2012-08/msg00013.html http://lists.opensuse.org/opensuse-updates/2012-08/msg00015.html http://rhn.redhat.com/errata/RHSA-2012-1122.html http://rhn.redhat.com/errata/RHSA-2012-1123.html http://secunia.com/advisories/51096 http://support.apple.com/kb/HT5880 http://www.debian.org/security/2012/dsa-2517 http://www.securitytracker.com/id?1027296 http://www.sla • CWE-20: Improper Input Validation •
CVSS: 8.5EPSS: 90%CPEs: 256EXPL: 0CVE-2012-1667 – bind: handling of zero length rdata can cause named to terminate unexpectedly
https://notcve.org/view.php?id=CVE-2012-1667
ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record. ISC BIND v9.x antes de v9.7.6-P1, v9.8.x antes de v9.8.3-P1, v9.9.x antes de v9.9.1-P1, y v9.4-ESV antes de 9.6-ESV-R7-P1 no gestionan adecuadamente los registros de recursos con una sección RDATA de longitud cero, lo que permite a los servidores DNS remotos provocar una denegación de servicio (caída del demonio o corrupción de datos) u obtener información sensible de la memoria del proceso a través de un registro específicamente diseñado para este fin. • http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00010.html http://marc.info/?l=bugtraq&m=134132772016230&w=2 http://rhn.redhat.com/errata/RHSA-2012-0717.html http://rhn.redhat.com/errata/RHSA-2012-1110.html http://secunia.com/advisories/51096 http://support.apple.com/kb/HT5501 http://www.debian.org/security/2012&#x • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 1%CPEs: 72EXPL: 0CVE-2012-1033 – bind: deleted domain name resolving flaw
https://notcve.org/view.php?id=CVE-2012-1033
The resolver in ISC BIND 9 through 9.8.1-P1 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. La resolución en ISC BIND v9 a v9.8.1-P1 no implementa una política de actualización de caché, que permite a atacantes remotos provocar resolubilidad continuada de nombres de dominio que ya no están registrados a través de un "Ghost Names exploit" • http://marc.info/?l=bugtraq&m=135638082529878&w=2 http://osvdb.org/78916 http://rhn.redhat.com/errata/RHSA-2012-0717.html http://secunia.com/advisories/47884 http://www.kb.cert.org/vuls/id/542123 http://www.securityfocus.com/bid/51898 http://www.securitytracker.com/id?1026647 https://exchange.xforce.ibmcloud.com/vulnerabilities/73053 https://hermes.opensuse.org/messages/15136456 https://hermes.opensuse.org/messages/15136477 https://www.isc.org/software/bind/advisories/ •
CVSS: 5.0EPSS: 10%CPEs: 239EXPL: 0CVE-2011-4313 – bind: Remote denial of service against recursive servers via logging negative cache entry
https://notcve.org/view.php?id=CVE-2011-4313
query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver. query.c en ISC BIND v9.0.x hasta v9.6.x, v9.4-ESV hasta v9.4-ESV-R5, v9.6-ESV hasta v9.6-ESV-R5, v9.7.0 hasta v9.7.4, v9.8.0 hasta v9.8.1, y v9.9.0a1 hasta v9.9.0b1, permite a atacantes remotos provocar una denegación de servicio a través de vectores relacionados con peticiones DNS recursivas, errores de registro, y la captura de un registro inválido por el 'resolver'. • http://blogs.oracle.com/sunsecurity/entry/cve_2011_4313_denial_of http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069463.html http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069970.html http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069975.html http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00027.html http://lists.opensuse.org/opensuse-security-announce •