CVSS: 2.6EPSS: 1%CPEs: 169EXPL: 0CVE-2009-4022 – bind: cache poisoning using not validated DNSSEC responses
https://notcve.org/view.php?id=CVE-2009-4022
Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed "at the same time as requesting DNSSEC records (DO)," aka Bug 20438. Vulnerabilidad no especificada en ISC BIND 9.0.x hasta la versión 9.3.x, 9.4 en versiones anteriores a 9.4.3-P4, 9.5 en versiones anteriores a 9.5.2-P1, 9.6 en versiones anteriores a 9.6.1-P2 y 9.7 beta en versiones anteriores a 9.7.0b3, con validación DNSSEC habilitada y comprobación deshabilitada (CD), permite a atacantes remotos llevar a cabo ataques de envenenamiento de la caché DNS recibiendo una consulta de cliente recursiva y enviando una respuesta que contiene una sección Additional con datos manipulados, lo cual no es manejado adecuadamente cuando la respuesta es procesada "al mismo tiempo que se solicitan registros DNSSEC (DO)", también conocida como Bug 20438. • ftp://ftp.sco.com/pub/unixware7/714/security/p535243_uw7/p535243b.txt http://aix.software.ibm.com/aix/efixes/security/bind9_advisory.asc http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://lists.vmware.com/pipermail/security-announce/2010/000082.html http://osvdb.org/60493 http://secunia.com/advisories/37426 http://secunia.com/advisories/37491 http://secunia.com/advisories/38219 http://secunia.com/advisories/38240 http://secunia.com/advisories/ •
CVSS: 5.0EPSS: 96%CPEs: 65EXPL: 1CVE-2009-0696 – ISC BIND 9 - Remote Dynamic Update Message Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2009-0696
The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message, as exploited in the wild in July 2009. La función dns_db_findrdataset en db.c en "named" en ISC BIND v9.4 anterior a v9.4.3-P3, v9.5 anterior a v9.5.1-P3, y v9.6 anterior a v9.6.1-P1, cuando está configurado como un servidor maestro, permite a atacantes remotos provocar una denegación de servicio (fallo de aserción y salida de demonio) a través de cualquier registro en la sección prerequerida de un mensaje de actualización dinámico manipulado, tal como se ha explotado en julio de 2009. • https://www.exploit-db.com/exploits/9300 ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-013.txt.asc ftp://ftp.sco.com/pub/unixware7/714/security/p535243_uw7/p535243b.txt http://aix.software.ibm.com/aix/efixes/security/bind_advisory.asc http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=538975 http://secunia.com/advisories/36035 http://secunia.com/advisories/36038 http://secunia.com/advisories/36050 http://secunia.com/advisories/36053 http://secunia.com • CWE-16: Configuration •
CVSS: 6.9EPSS: 0%CPEs: 16EXPL: 0CVE-2009-1893 – dhcp: insecure temporary file use in the dhcpd init script
https://notcve.org/view.php?id=CVE-2009-1893
The configtest function in the Red Hat dhcpd init script for DHCP 3.0.1 in Red Hat Enterprise Linux (RHEL) 3 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file, related to the "dhcpd -t" command. La función configtest en la secuencia de comandos de inicio del DHCPD en Red Hat para DHCP 3.0.1 en Red Hat Enterprise Linux (RHEL) 3 permite a usuarios locales sobrescribir ficheros de su elección a través de un ataque de enlace simbólico sobre un fichero temporal no especificado, relativo al comando "dhcpd -t". • http://secunia.com/advisories/35831 http://securitytracker.com/id?1022554 http://www.redhat.com/support/errata/RHSA-2009-1154.html http://www.securityfocus.com/bid/35670 https://bugzilla.redhat.com/show_bug.cgi?id=510024 https://exchange.xforce.ibmcloud.com/vulnerabilities/51718 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11597 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6440 https://access.redhat.com/security&#x • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-377: Insecure Temporary File •
CVSS: 5.0EPSS: 7%CPEs: 5EXPL: 0CVE-2009-1892
https://notcve.org/view.php?id=CVE-2009-1892
dhcpd in ISC DHCP 3.0.4 and 3.1.1, when the dhcp-client-identifier and hardware ethernet configuration settings are both used, allows remote attackers to cause a denial of service (daemon crash) via unspecified requests. dhcpd en ISC DHCP v3.0.4 y v3.1.1, cuando se utilizan de forma simultánea el identificador de cliente dhcp y la configuración de hardware ethernet, permite a atacantes remotos provocar una denegación de servicio (caída del demonio) a través de una petición no especificada. • http://secunia.com/advisories/35830 http://secunia.com/advisories/35851 http://secunia.com/advisories/36457 http://secunia.com/advisories/37342 http://www.debian.org/security/2009/dsa-1833 http://www.mandriva.com/security/advisories?name=MDVSA-2009:154 http://www.securityfocus.com/bid/35669 https://exchange.xforce.ibmcloud.com/vulnerabilities/51717 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01177.html https://www.redhat.com/archives/fedora-package-announce/200 • CWE-16: Configuration •
CVSS: 10.0EPSS: 7%CPEs: 5EXPL: 1CVE-2009-0692 – ISC DHCP dhclient < 3.1.2p1 - Remote Buffer Overflow (PoC)
https://notcve.org/view.php?id=CVE-2009-0692
Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option. Desbordamiento de búfer basado en pila en el método script_write_params en client/dhclient.c en ISC DHCP dhclient v4.1 anteriores a v4.1.0p1, v4.0 anteriores a v4.0.1p1, v3.1 anteriores a v3.1.2p1, v3.0, y v2.0 permite a servidores DHCP remotos ejecutar código arbitrario a través de una opción manipulada subnet-mask. • https://www.exploit-db.com/exploits/9265 http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-010.txt.asc http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083 http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00003.html http://secunia.com/advisories/35785 http://secunia.com/advisories/35829 http://secunia.com/advisories/35830 http://secunia.com/advisories/35831 http://secunia.com/advisories/35832 http://secunia.com/advisories/35841 http • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •