CVSS: 6.8EPSS: 0%CPEs: 58EXPL: 0CVE-2013-6230
https://notcve.org/view.php?id=CVE-2013-6230
The Winsock WSAIoctl API in Microsoft Windows Server 2008, as used in ISC BIND 9.6-ESV before 9.6-ESV-R10-P1, 9.8 before 9.8.6-P1, 9.9 before 9.9.4-P1, 9.9.3-S1, 9.9.4-S1, and other products, does not properly support the SIO_GET_INTERFACE_LIST command for netmask 255.255.255.255, which allows remote attackers to bypass intended IP address restrictions by leveraging misinterpretation of this netmask as a 0.0.0.0 netmask. El API Winsock WSAloctl en Microsoft Windows Server 2008, utilizado en ISC BIND 9.6-ESV (anterior a 9.6-ESV-R10-P1), 9.8 (anterior a 9.8.6-P1), 9.9 (anterior a 9.9.4-P1, 9.9.3-S1, 9.9.4-S1), y otros productos, no soportan apropiadamente el comando SIO_GET_INTERFACE_LIST para la máscara de red 255.255.255.255, lo que permite a atacantes remotos sorterar restricciones de dirección IP aprovechando la reinterpretación de esta máscara como 0.0.0.0 • http://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.518391 https://kb.isc.org/article/AA-01062 https://kb.isc.org/article/AA-01063 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 94%CPEs: 109EXPL: 0CVE-2013-4854 – ISC BIND rdata Denial Of Service Vulnerability
https://notcve.org/view.php?id=CVE-2013-4854
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013. La implementación RFC en rdata.c en ISC BIND 9.7.x y 9.8.x anterior a 9.8.5-P2, 9.8.6b1, 9.9.x anterior a 9.9.3-P2, y 9.9.4b1, y DNSco BIND 9.9.3-S1 anterior a 9.9.3-S1-P1 y 9.9.4-S1b1, permite a atacantes remotos provocar una denegación de servicio (fallo de aserción y salida de demonio) a través de una petición con una sección RDATA manipulada que se maneja adecuadamente durante la contrucción de mensaje de log. Ha sido explotada "in the wild" en Julio de 2013. This vulnerability allows remote attackers to cause a denial of service condition on vulnerable installations of ISC BIND. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of an rdata section with a length that is less than four. • http://archives.neohapsis.com/archives/bugtraq/2013-08/0030.html http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html http://linux.oracle.com/errata/ELSA-2014-1244 http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113108.html http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113251.html http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00018.html http://rhn. •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2013-3919
https://notcve.org/view.php?id=CVE-2013-3919
resolver.c in ISC BIND 9.8.5 before 9.8.5-P1, 9.9.3 before 9.9.3-P1, and 9.6-ESV-R9 before 9.6-ESV-R9-P1, when a recursive resolver is configured, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a record in a malformed zone. resolver.c en ISC BIND 9.8.5 anterior a 9.8.5-P1, 9.9.3 anterior a 9.9.3-P1, y 9.6-ESV-R9 anterior a 9.6-ESV-R9-P1, cuando un "resolver" está configurado como recursivo, permite a atacantes remotos provocar una denegación de servicio (fallo de declaración y salida del demonio "named") a través de una petición para un registro en una zona mal formada. • http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html https://kb.isc.org/article/AA-00967 https://support.apple.com/kb/HT6536 •
CVSS: 7.8EPSS: 90%CPEs: 68EXPL: 0CVE-2013-2266 – bind: libdns regular expressions excessive resource consumption DoS
https://notcve.org/view.php?id=CVE-2013-2266
libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running a named process. libdns en ISC BIND v9.7.x y v9.8.x antes v9.8.4-P2, v9.8.5 antes de v9.8.5b2, v9.9.x antes de v9.9.2-P2, y v9.9.3 antes v9.9.3b2 en plataformas UNIX permite a atacantes remotos para causar una denegación de servicio (consumo de memoria) a través de una expresión regular manipulada, como lo demuestra un ataque memoria de agotamiento contra un equipo que ejecuta un proceso llamado. • http://linux.oracle.com/errata/ELSA-2014-1244 http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101500.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101603.html http://marc.info/?l=bugtraq&m=136804614120794&w=2 http://rhn.redhat.com/errata/RHSA-2013-0689.html http://rhn.redhat.com/errata/RHSA-2013-0690.html http://support.apple.com/kb/HT5880 http://www.debia • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.1EPSS: 1%CPEs: 43EXPL: 0CVE-2012-5689 – bind: denial of service when processing queries and with both DNS64 and RPZ enabled
https://notcve.org/view.php?id=CVE-2012-5689
ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record. ISC BIND v9.8.x hasta 9.8.4-P1 y v9.9.x hasta v9.9.2-P1, en ??ciertas configuraciones que implican DNS64 con una zona de política de respuesta que carece de una regla de reescritura AAAA, permite a atacantes remotos provocar una denegación de servicio (aserción fracaso y salida llamado demonio) a través de una consulta para un registro AAAA. • http://rhn.redhat.com/errata/RHSA-2013-0550.html http://www.isc.org/software/bind/advisories/cve-2012-5689 http://www.ubuntu.com/usn/USN-2693-1 https://kb.isc.org/article/AA-00855 https://access.redhat.com/security/cve/CVE-2012-5689 https://bugzilla.redhat.com/show_bug.cgi?id=903417 • CWE-20: Improper Input Validation •