CVSS: 6.8EPSS: 1%CPEs: 97EXPL: 0CVE-2009-0025 – bind: DSA_do_verify() returns check issue
https://notcve.org/view.php?id=CVE-2009-0025
BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3 y versiones anteriores no comprueba adecuadamente el valor de retorno de la función OpenSSL DSA_verify, lo que permite a atacantes remotos eludir la validación de la cadena del certificado a través de una firma SSL/TLS mal formada, una vulnerabilidad similar a CVE-2008-5077. • http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33 http://lists.apple.com/archives/security-announce/2009/May/msg00002.html http://marc.info/?l=bugtraq&m=141879471518471&w=2 http://secunia.com/advisories/33494 http://secunia.com/advisories/33546 http://secunia.com/advisories/33551 http://secunia.com/advisories/33559 http://secunia.com/advisories/33683 http://secunia.com/advisories/33882 http://secunia.com/advisories/35074 http://security&# • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 3%CPEs: 3EXPL: 0CVE-2008-4163
https://notcve.org/view.php?id=CVE-2008-4163
Unspecified vulnerability in ISC BIND 9.3.5-P2-W1, 9.4.2-P2-W1, and 9.5.0-P2-W1 on Windows allows remote attackers to cause a denial of service (UDP client handler termination) via unknown vectors. Vulnerabilidad sin especificar en ISC BIND 9.3.5-P2-W1, 9.4.2-P2-W1, y 9.5.0-P2-W1 sobre Windows, permite a atacantes remotos provocar una denegación de servicio (caída del manejador cliente UDP) a través de vectores desconocidos. • http://marc.info/?l=bind-announce&m=122180244228376&w=2 http://marc.info/?l=bind-announce&m=122180244228378&w=2 http://marc.info/?l=bind-announce&m=122180376630150&w=2 http://secunia.com/advisories/31924 http://www.securityfocus.com/bid/31252 http://www.securitytracker.com/id?1020901 http://www.vupen.com/english/advisories/2008/2637 https://exchange.xforce.ibmcloud.com/vulnerabilities/45234 • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 1%CPEs: 3EXPL: 0CVE-2007-2925
https://notcve.org/view.php?id=CVE-2007-2925
The default access control lists (ACL) in ISC BIND 9.4.0, 9.4.1, and 9.5.0a1 through 9.5.0a5 do not set the allow-recursion and allow-query-cache ACLs, which allows remote attackers to make recursive queries and query the cache. La lista de control de acceso por defecto (ACL) en ISC BIND 9.4.0, 9.4.1, y 9.5.0a1 hasta 9.5.0a5 no asigna las ACLs allow-recursion y allow-query-cache, lo cual permite a atacantes remotos realizar consultas recursivas y consultar la cache. • http://secunia.com/advisories/26227 http://secunia.com/advisories/26236 http://secunia.com/advisories/26509 http://secunia.com/advisories/26515 http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=623903 http://www.gentoo.org/security/en/glsa/glsa-200708-13.xml http://www.isc.org/index.pl?/sw/bind/bind-security.php http://www.mandriva.com/security/advisories?name=MDKSA-2007:149 http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.022.html http://www.secu •
CVSS: 4.3EPSS: 29%CPEs: 7EXPL: 1CVE-2007-2926 – BIND 9 0.3beta - DNS Cache Poisoning
https://notcve.org/view.php?id=CVE-2007-2926
ISC BIND 9 through 9.5.0a5 uses a weak random number generator during generation of DNS query ids when answering resolver questions or sending NOTIFY messages to slave name servers, which makes it easier for remote attackers to guess the next query id and perform DNS cache poisoning. ISC BIND 9 hasta 9.5.0a5 utiliza un número aleatorio debil a lo largo de la generación de la consulta DNS ids cuando se responde la pregunta a resolver o enviando mensajes NOTIFY a servidores de nombre esclavos, lo cual hace más fácil para atacantes remotos para adivinar la siguiente consulta id y llevar a cabo envenenamientos de la cache DNS. • https://www.exploit-db.com/exploits/4266 ftp://aix.software.ibm.com/aix/efixes/security/README ftp://patches.sgi.com/support/free/security/advisories/20070801-01-P.asc http://docs.info.apple.com/article.html?artnum=307041 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01123426 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01154600 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01174368 http://lists.apple.com/archives/ •
CVSS: 7.1EPSS: 8%CPEs: 2EXPL: 0CVE-2007-2241
https://notcve.org/view.php?id=CVE-2007-2241
Unspecified vulnerability in query.c in ISC BIND 9.4.0, and 9.5.0a1 through 9.5.0a3, when recursion is enabled, allows remote attackers to cause a denial of service (daemon exit) via a sequence of queries processed by the query_addsoa function. Vulnerabilidad sin especificar en el query.c del ISC BIND 9.4.0 y del 9.5.0a1 hasta la 9.5.0a3, cuando la recursividad está activada, permite a atacantes remotos provocar una denegación de servicio (salida del demonio) a través de una secuencia de sentencias procesadas a través de la función query_addsoa. • http://osvdb.org/34748 http://secunia.com/advisories/25070 http://www.isc.org/index.pl?/sw/bind/bind-security.php http://www.kb.cert.org/vuls/id/718460 http://www.mandriva.com/security/advisories?name=MDKSA-2007:100 http://www.securityfocus.com/bid/23738 http://www.securitytracker.com/id?1017985 http://www.vupen.com/english/advisories/2007/1593 https://exchange.xforce.ibmcloud.com/vulnerabilities/33988 •