CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2014-8680
https://notcve.org/view.php?id=CVE-2014-8680
The GeoIP functionality in ISC BIND 9.10.0 through 9.10.1 allows remote attackers to cause a denial of service (assertion failure and named exit) via vectors related to (1) the lack of GeoIP databases for both IPv4 and IPv6, or (2) IPv6 support with certain options. La funcionalidad GeoIP en ISC BIND 9.10.0 hasta 9.10.1 permite a atacantes remotos causar una denegación de servicio (fallo de aserción y salida nombrada) a través de vectores relacionados con (1) la falta de bases de datos GeoIP para IPv4 y IPv6, o (2) el soporte IPv6 con ciertas opciones. • http://security.gentoo.org/glsa/glsa-201502-03.xml https://kb.isc.org/article/AA-01217 https://security.netapp.com/advisory/ntap-20190730-0002 • CWE-20: Improper Input Validation CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 83%CPEs: 63EXPL: 0CVE-2014-8500 – bind: delegation handling denial of service
https://notcve.org/view.php?id=CVE-2014-8500
ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals. ISC BIND 9.0.x hasta 9.8.x, 9.9.0 hasta 9.9.6, y 9.10.0 hasta 9.10.1 no limita el encadenamiento de la delegación, lo que permite a atacantes remotos causar una denegación de servicio (consumo de memoria y caída del nombrado) a través de un número grande o infinito de referencias. A denial of service flaw was found in the way BIND followed DNS delegations. A remote attacker could use a specially crafted zone containing a large number of referrals which, when looked up and processed, would cause named to use excessive amounts of memory or crash. • http://advisories.mageia.org/MGASA-2014-0524.html http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-002.txt.asc http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10676 http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00017.html http://lists&# • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 0CVE-2014-3859
https://notcve.org/view.php?id=CVE-2014-3859
libdns in ISC BIND 9.10.0 before P2 does not properly handle EDNS options, which allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted packet, as demonstrated by an attack against named, dig, or delv. libdns en ISC BIND 9.10.0 anterior a P2 no maneja debidamente las opciones EDNS, lo que permite a atacantes remotos causar una denegación de servicio (fallo de aserción REQUIRE y salida de demonio) a través de un paquete manipulado, tal y como fue demostrado por un ataque contra 'named', 'dig' o 'delv'. • http://secunia.com/advisories/58946 http://www.securityfocus.com/bid/68193 http://www.securitytracker.com/id/1030414 https://kb.isc.org/article/AA-01166 https://kb.isc.org/article/AA-01171 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3214
https://notcve.org/view.php?id=CVE-2014-3214
The prefetch implementation in named in ISC BIND 9.10.0, when a recursive nameserver is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a DNS query that triggers a response with unspecified attributes. La implementación Prefetch en named en ISC BIND 9.10.0, cuando un servidor de nombres recursivo está habilitado, permite a atacantes remotos causar una denegación de servicio (fallo de aserción REQUIRE y salida de demonio) a través de una consulta DNS que provoca una respuesta con atributos no especificados. • http://security.gentoo.org/glsa/glsa-201502-03.xml http://www.securitytracker.com/id/1030214 https://kb.isc.org/article/AA-01161 • CWE-20: Improper Input Validation •
CVSS: 7.6EPSS: 4%CPEs: 168EXPL: 0CVE-2010-0382 – bind: out-of-bailiwick data vulnerability due to regression while fixing CVE-2009-4022
https://notcve.org/view.php?id=CVE-2010-0382
ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022. ISC BIND 9.0.x a 9.3.x, 9.4 en versiones anteriores a la 9.4.3-P5, 9.5 en versiones anteriores a la 9.5.2-P2, 9.6 en versiones anteriores a la 9.6.1-P3, y 9.7.0 beta maneja de manera inapropiada los datos de acompañamiento de una respuesta segura sin volver a consultar a la fuente original, lo que permite a atacantes remotos tener un impacto no especificado mediante una respuesta manipulada, también conocido como Bug 20819. NOTA: esta vulnerabilidad existe debido a una regresión durante la solución de CVE-2009-4022. • http://secunia.com/advisories/40086 http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0018 http://www.debian.org/security/2010/dsa-2054 http://www.vupen.com/english/advisories/2010/0622 http://www.vupen.com/english/advisories/2010/1352 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11753 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6665 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval •