CVSS: 7.8EPSS: 95%CPEs: 109EXPL: 0CVE-2013-4854 – ISC BIND rdata Denial Of Service Vulnerability
https://notcve.org/view.php?id=CVE-2013-4854
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013. La implementación RFC en rdata.c en ISC BIND 9.7.x y 9.8.x anterior a 9.8.5-P2, 9.8.6b1, 9.9.x anterior a 9.9.3-P2, y 9.9.4b1, y DNSco BIND 9.9.3-S1 anterior a 9.9.3-S1-P1 y 9.9.4-S1b1, permite a atacantes remotos provocar una denegación de servicio (fallo de aserción y salida de demonio) a través de una petición con una sección RDATA manipulada que se maneja adecuadamente durante la contrucción de mensaje de log. Ha sido explotada "in the wild" en Julio de 2013. This vulnerability allows remote attackers to cause a denial of service condition on vulnerable installations of ISC BIND. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of an rdata section with a length that is less than four. • http://archives.neohapsis.com/archives/bugtraq/2013-08/0030.html http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html http://linux.oracle.com/errata/ELSA-2014-1244 http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113108.html http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113251.html http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00018.html http://rhn. •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2013-3919
https://notcve.org/view.php?id=CVE-2013-3919
resolver.c in ISC BIND 9.8.5 before 9.8.5-P1, 9.9.3 before 9.9.3-P1, and 9.6-ESV-R9 before 9.6-ESV-R9-P1, when a recursive resolver is configured, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a record in a malformed zone. resolver.c en ISC BIND 9.8.5 anterior a 9.8.5-P1, 9.9.3 anterior a 9.9.3-P1, y 9.6-ESV-R9 anterior a 9.6-ESV-R9-P1, cuando un "resolver" está configurado como recursivo, permite a atacantes remotos provocar una denegación de servicio (fallo de declaración y salida del demonio "named") a través de una petición para un registro en una zona mal formada. • http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html https://kb.isc.org/article/AA-00967 https://support.apple.com/kb/HT6536 •
CVSS: 7.8EPSS: 94%CPEs: 68EXPL: 0CVE-2013-2266 – bind: libdns regular expressions excessive resource consumption DoS
https://notcve.org/view.php?id=CVE-2013-2266
libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running a named process. libdns en ISC BIND v9.7.x y v9.8.x antes v9.8.4-P2, v9.8.5 antes de v9.8.5b2, v9.9.x antes de v9.9.2-P2, y v9.9.3 antes v9.9.3b2 en plataformas UNIX permite a atacantes remotos para causar una denegación de servicio (consumo de memoria) a través de una expresión regular manipulada, como lo demuestra un ataque memoria de agotamiento contra un equipo que ejecuta un proceso llamado. • http://linux.oracle.com/errata/ELSA-2014-1244 http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101500.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101603.html http://marc.info/?l=bugtraq&m=136804614120794&w=2 http://rhn.redhat.com/errata/RHSA-2013-0689.html http://rhn.redhat.com/errata/RHSA-2013-0690.html http://support.apple.com/kb/HT5880 http://www.debia • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.1EPSS: 1%CPEs: 43EXPL: 0CVE-2012-5689 – bind: denial of service when processing queries and with both DNS64 and RPZ enabled
https://notcve.org/view.php?id=CVE-2012-5689
ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record. ISC BIND v9.8.x hasta 9.8.4-P1 y v9.9.x hasta v9.9.2-P1, en ??ciertas configuraciones que implican DNS64 con una zona de política de respuesta que carece de una regla de reescritura AAAA, permite a atacantes remotos provocar una denegación de servicio (aserción fracaso y salida llamado demonio) a través de una consulta para un registro AAAA. • http://rhn.redhat.com/errata/RHSA-2013-0550.html http://www.isc.org/software/bind/advisories/cve-2012-5689 http://www.ubuntu.com/usn/USN-2693-1 https://kb.isc.org/article/AA-00855 https://access.redhat.com/security/cve/CVE-2012-5689 https://bugzilla.redhat.com/show_bug.cgi?id=903417 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 3%CPEs: 39EXPL: 0CVE-2012-5688 – bind: DoS on servers using DNS64
https://notcve.org/view.php?id=CVE-2012-5688
ISC BIND 9.8.x before 9.8.4-P1 and 9.9.x before 9.9.2-P1, when DNS64 is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query. ISC BIND v9.8.x antes de v9.8.4-P1 y v9.9.x antes de v9.9.2-P1, cuando DNS64 está activado, permite a atacantes remotos provocar una denegación de servicio (error de aserción y salida del demonio) a través de una consulta manipulada. • http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html http://rhn.redhat.com/errata/RHSA-2012-1549.html http://support.apple.com/kb/HT5880 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.536004 http://www.ubuntu.com/usn/USN-1657-1 https://kb.isc.org/article/AA-00828 https://access.redhat.com/security/cve/CVE-2012-5688 https://bugzilla.redhat.com/show_bug.cgi?id=883533 • CWE-20: Improper Input Validation •