CVSS: 7.8EPSS: 8%CPEs: 278EXPL: 0CVE-2012-5166 – bind: Specially crafted DNS data can cause a lockup in named
https://notcve.org/view.php?id=CVE-2012-5166
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records. ISC BIND v9.x antes de v9.7.6-P4, v9.8.x antes de v9.8.3-P4, v9.9.x antes de v9.9.1-P4, y v9.4-ESV y 9.6-ESV antes de v9.6-ESV-R7-P, permite a atacantes remotos provocar una denegación de servicio a través de combinaciones no especificadas de registros de recursos. • http://aix.software.ibm.com/aix/efixes/security/bind9_advisory5.asc http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090346.html http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090491.html http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090586.html http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00011.html http://lists.opensuse.org/opensuse-security-announce • CWE-189: Numeric Errors •
CVSS: 7.8EPSS: 29%CPEs: 278EXPL: 0CVE-2012-4244 – bind: specially crafted resource record causes named to exit
https://notcve.org/view.php?id=CVE-2012-4244
ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P3 allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a long resource record. ISC BIND v9.x antes de v9.7.6-P3, v9.8.x antes de v9.8.3-P3, v9.9.x antes de v9.9.1-P3, y v9.4-ESV y v9.6-ESV antes de v9.6-ESV-R7-P3 permite provocar una denegación de servicio (error de aserción y salida de demonio) a atacantes remotos a través de una consulta para un registro de recursos demasiado largo. • http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087697.html http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087703.html http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088381.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00022.html http://lists.opensuse.org/opensuse-security& •
CVSS: 7.8EPSS: 6%CPEs: 94EXPL: 0CVE-2012-3817 – bind: heavy DNSSEC validation load can cause assertion failure
https://notcve.org/view.php?id=CVE-2012-3817
ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) by sending many queries. ISC BIND v9.4.x, v9.5.x, v9.6.x, v9.7.x, y antes de v9.7.6-P2; v9.8.x antes de v9.8.3-P2; v9.9.x antes de v9.9.1-P2, y v9.6-ESV antes v9.6-ESV-vR7-P2, cuando está habilitada la validación DNSSEC, no inicializar correctamente la caché no-query, que permite a atacantes remotos provocar una denegación de servicio (error de aserción y salida demonio) mediante el envío de muchas consultas. • http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html http://lists.opensuse.org/opensuse-updates/2012-08/msg00013.html http://lists.opensuse.org/opensuse-updates/2012-08/msg00015.html http://rhn.redhat.com/errata/RHSA-2012-1122.html http://rhn.redhat.com/errata/RHSA-2012-1123.html http://secunia.com/advisories/51096 http://support.apple.com/kb/HT5880 http://www.debian.org/security/2012/dsa-2517 http://www.securitytracker.com/id?1027296 http://www.sla • CWE-20: Improper Input Validation •
CVSS: 8.5EPSS: 90%CPEs: 256EXPL: 0CVE-2012-1667 – bind: handling of zero length rdata can cause named to terminate unexpectedly
https://notcve.org/view.php?id=CVE-2012-1667
ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record. ISC BIND v9.x antes de v9.7.6-P1, v9.8.x antes de v9.8.3-P1, v9.9.x antes de v9.9.1-P1, y v9.4-ESV antes de 9.6-ESV-R7-P1 no gestionan adecuadamente los registros de recursos con una sección RDATA de longitud cero, lo que permite a los servidores DNS remotos provocar una denegación de servicio (caída del demonio o corrupción de datos) u obtener información sensible de la memoria del proceso a través de un registro específicamente diseñado para este fin. • http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00010.html http://marc.info/?l=bugtraq&m=134132772016230&w=2 http://rhn.redhat.com/errata/RHSA-2012-0717.html http://rhn.redhat.com/errata/RHSA-2012-1110.html http://secunia.com/advisories/51096 http://support.apple.com/kb/HT5501 http://www.debian.org/security/2012&#x • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 10%CPEs: 239EXPL: 0CVE-2011-4313 – bind: Remote denial of service against recursive servers via logging negative cache entry
https://notcve.org/view.php?id=CVE-2011-4313
query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver. query.c en ISC BIND v9.0.x hasta v9.6.x, v9.4-ESV hasta v9.4-ESV-R5, v9.6-ESV hasta v9.6-ESV-R5, v9.7.0 hasta v9.7.4, v9.8.0 hasta v9.8.1, y v9.9.0a1 hasta v9.9.0b1, permite a atacantes remotos provocar una denegación de servicio a través de vectores relacionados con peticiones DNS recursivas, errores de registro, y la captura de un registro inválido por el 'resolver'. • http://blogs.oracle.com/sunsecurity/entry/cve_2011_4313_denial_of http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069463.html http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069970.html http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069975.html http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00027.html http://lists.opensuse.org/opensuse-security-announce •