CVE-2009-0696

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message, as exploited in the wild in July 2009.

References

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-013.txt.asc

ftp://ftp.sco.com/pub/unixware7/714/security/p535243_uw7/p535243b.txt

http://aix.software.ibm.com/aix/efixes/security/bind_advisory.asc

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=538975

http://secunia.com/advisories/36035

http://secunia.com/advisories/36038

http://secunia.com/advisories/36050

http://secunia.com/advisories/36053

http://secunia.com/advisories/36056

http://secunia.com/advisories/36063

http://secunia.com/advisories/36086

http://secunia.com/advisories/36098

http://secunia.com/advisories/36192

http://secunia.com/advisories/37471

http://secunia.com/advisories/39334

http://sunsolve.sun.com/search/document.do?assetkey=1-26-264828-1

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020788.1-1

http://up2date.astaro.com/2009/08/up2date_7505_released.html

http://wiki.rpath.com/Advisories:rPSA-2009-0113

http://www.kb.cert.org/vuls/id/725188

http://www.openbsd.org/errata44.html#014_bind

http://www.securityfocus.com/archive/1/505403/100/0/threaded

http://www.securityfocus.com/archive/1/507985/100/0/threaded

http://www.securitytracker.com/id?1022613

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.561499

http://www.ubuntu.com/usn/usn-808-1

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

http://www.vupen.com/english/advisories/2009/2036

http://www.vupen.com/english/advisories/2009/2088

http://www.vupen.com/english/advisories/2009/2171

http://www.vupen.com/english/advisories/2009/2247

http://www.vupen.com/english/advisories/2009/3316

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10414

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12245

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7806

https://www.isc.org/node/474

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01265.html

Details

Source: MITRE

Published: 2009-07-29

Updated: 2018-10-10

Type: CWE-16

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:isc:bind:9.4:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:a1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:a2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:a3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:a4:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:a5:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:a6:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:b1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:b2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:b3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:b4:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.1:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.2:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.2:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.2:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.3:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.3:b1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.3:b2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.3:b3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.3:p2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a4:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a5:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a6:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a7:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:b1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:b2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:b3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:p1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:p2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:p2_w1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:p2_w2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6:*:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r2:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r3:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r4:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r4_p1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r5:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r5_b1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r5_p1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r6:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r6_b1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r6_rc1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r6_rc2:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r7:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r7_p1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r7_p2:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r9:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r9_p1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6.0:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.0:a1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.0:b1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.0:p1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.0:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.0:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.1:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.1:b1:*:*:*:*:*:*

Tenable Plugins

View all (86 total)

IDNameProductFamilySeverity
149803Solaris 10 (x86) : 119784-47NessusSolaris Local Security Checks
medium
149794Solaris 10 (sparc) : 119783-47NessusSolaris Local Security Checks
medium
147379NewStart CGSL CORE 5.04 / MAIN 5.04 : bind Multiple Vulnerabilities (NS-SA-2021-0017)NessusNewStart CGSL Local Security Checks
critical
140364Solaris 10 (x86) : 119784-46NessusSolaris Local Security Checks
medium
140363Solaris 10 (sparc) : 119783-46NessusSolaris Local Security Checks
medium
138427Solaris 10 (x86) : 119784-45NessusSolaris Local Security Checks
medium
138421Solaris 10 (sparc) : 119783-45NessusSolaris Local Security Checks
medium
137170OracleVM 3.3 / 3.4 : bind (OVMSA-2020-0021)NessusOracleVM Local Security Checks
high
135440Solaris 10 (x86) : 119784-44NessusSolaris Local Security Checks
medium
135434Solaris 10 (sparc) : 119783-44NessusSolaris Local Security Checks
medium
129874Solaris 10 (x86) : 119784-43NessusSolaris Local Security Checks
medium
129870Solaris 10 (sparc) : 119783-43NessusSolaris Local Security Checks
medium
126726Solaris 10 (x86) : 119784-42NessusSolaris Local Security Checks
medium
126716Solaris 10 (sparc) : 119783-42NessusSolaris Local Security Checks
medium
121180Solaris 10 (x86) : 119784-41NessusSolaris Local Security Checks
medium
121174Solaris 10 (sparc) : 119783-41NessusSolaris Local Security Checks
medium
107845Solaris 10 (x86) : 119784-40NessusSolaris Local Security Checks
medium
107844Solaris 10 (x86) : 119784-39NessusSolaris Local Security Checks
medium
107843Solaris 10 (x86) : 119784-38NessusSolaris Local Security Checks
medium
107842Solaris 10 (x86) : 119784-37NessusSolaris Local Security Checks
medium
107841Solaris 10 (x86) : 119784-36NessusSolaris Local Security Checks
medium
107840Solaris 10 (x86) : 119784-33NessusSolaris Local Security Checks
medium
107839Solaris 10 (x86) : 119784-32NessusSolaris Local Security Checks
medium
107838Solaris 10 (x86) : 119784-31NessusSolaris Local Security Checks
medium
107837Solaris 10 (x86) : 119784-30NessusSolaris Local Security Checks
medium
107836Solaris 10 (x86) : 119784-29NessusSolaris Local Security Checks
medium
107835Solaris 10 (x86) : 119784-25NessusSolaris Local Security Checks
medium
107342Solaris 10 (sparc) : 119783-40NessusSolaris Local Security Checks
medium
107341Solaris 10 (sparc) : 119783-39NessusSolaris Local Security Checks
medium
107340Solaris 10 (sparc) : 119783-38NessusSolaris Local Security Checks
medium
107339Solaris 10 (sparc) : 119783-37NessusSolaris Local Security Checks
medium
107338Solaris 10 (sparc) : 119783-36NessusSolaris Local Security Checks
medium
107337Solaris 10 (sparc) : 119783-33NessusSolaris Local Security Checks
medium
107336Solaris 10 (sparc) : 119783-32NessusSolaris Local Security Checks
medium
107335Solaris 10 (sparc) : 119783-31NessusSolaris Local Security Checks
medium
107334Solaris 10 (sparc) : 119783-30NessusSolaris Local Security Checks
medium
107333Solaris 10 (sparc) : 119783-29NessusSolaris Local Security Checks
medium
107332Solaris 10 (sparc) : 119783-25NessusSolaris Local Security Checks
medium
99569OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0066)NessusOracleVM Local Security Checks
high
89117VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0016) (remote check)NessusMisc.
critical
78119F5 Networks BIG-IP : BIND vulnerability (SOL10366)NessusF5 Networks Local Security Checks
medium
67901Oracle Linux 3 : bind (ELSA-2009-1181)NessusOracle Linux Local Security Checks
medium
67900Oracle Linux 4 : bind (ELSA-2009-1180)NessusOracle Linux Local Security Checks
medium
67899Oracle Linux 5 : bind (ELSA-2009-1179)NessusOracle Linux Local Security Checks
medium
63797AIX 6.1 TL 3 : bind (IZ56318)NessusAIX Local Security Checks
medium
63796AIX 6.1 TL 2 : bind (IZ56317)NessusAIX Local Security Checks
medium
63795AIX 6.1 TL 1 : bind (IZ56316)NessusAIX Local Security Checks
medium
63794AIX 6.1 TL 0 : bind (IZ56315)NessusAIX Local Security Checks
medium
63793AIX 5.3 TL 10 : bind (IZ56314)NessusAIX Local Security Checks
medium
63792AIX 5.3 TL 9 : bind (IZ56313)NessusAIX Local Security Checks
medium
63791AIX 5.3 TL 8 : bind (IZ56312)NessusAIX Local Security Checks
medium
63790AIX 5.3 TL 7 : bind (IZ56311)NessusAIX Local Security Checks
medium
60629Scientific Linux Security Update : bind security for SL 4.x on i386/x86_64NessusScientific Linux Local Security Checks
medium
60628Scientific Linux Security Update : bind for SL 5.x on i386/x86_64NessusScientific Linux Local Security Checks
medium
60627Scientific Linux Security Update : bind for SL 3.0.x on i386/x86_64NessusScientific Linux Local Security Checks
medium
54872Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 8.1 / 9.0 / 9.1 / current : bind (SSA:2009-210-01)NessusSlackware Local Security Checks
medium
46813HP-UX PHNE_40339 : s700_800 11.23 BIND 9.2.0 Revision 5.0NessusHP-UX Local Security Checks
high
44712Debian DSA-1847-1 : bind9 - improper assertNessusDebian Local Security Checks
medium
43772CentOS 5 : bind (CESA-2009:1179)NessusCentOS Local Security Checks
medium
42870VMSA-2009-0016 : VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.NessusVMware ESX Local Security Checks
medium
41991openSUSE 10 Security Update : bind (bind-6383)NessusSuSE Local Security Checks
medium
41480SuSE 10 Security Update : bind (ZYPP Patch Number 6382)NessusSuSE Local Security Checks
medium
41370SuSE 11 Security Update : bind (SAT Patch Number 1147)NessusSuSE Local Security Checks
medium
41316SuSE9 Security Update : bind (YOU Patch Number 12462)NessusSuSE Local Security Checks
medium
40591Mac OS X BIND Dynamic Update Message Handling Remote DoS (Security Update 2009-004)NessusMacOS X Local Security Checks
medium
40463GLSA-200908-02 : BIND: Denial of ServiceNessusGentoo Local Security Checks
medium
40461FreeBSD : BIND -- Dynamic update message remote DoS (83725c91-7c7e-11de-9672-00e0815b8da8)NessusFreeBSD Local Security Checks
medium
40450ISC BIND 9 Dynamic Update Handling Remote DoS (intrusive check)NessusDNS
medium
40444openSUSE Security Update : bind (bind-1146)NessusSuSE Local Security Checks
medium
40442openSUSE Security Update : bind (bind-1146)NessusSuSE Local Security Checks
medium
40436CentOS 4 : bind (CESA-2009:1180)NessusCentOS Local Security Checks
medium
40433RHEL 3 : bind (RHSA-2009:1181)NessusRed Hat Local Security Checks
medium
40432RHEL 4 : bind (RHSA-2009:1180)NessusRed Hat Local Security Checks
medium
40431RHEL 5 : bind (RHSA-2009:1179)NessusRed Hat Local Security Checks
medium
40430Mandriva Linux Security Advisory : bind (MDVSA-2009:181)NessusMandriva Local Security Checks
medium
40428Fedora 10 : bind-9.5.1-3.P3.fc10 / Fedora 11 : bind-9.6.1-4.P1.fc11 (2009-8119)NessusFedora Local Security Checks
medium
40423CentOS 3 : bind (CESA-2009:1181)NessusCentOS Local Security Checks
medium
5107ISC BIND Dynamic Update Message Handling Remote DoS (deprecated)Nessus Network MonitorDNS Servers
high
40422ISC BIND Dynamic Update Message Handling Remote DoSNessusDNS
medium
40417Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : bind9 vulnerability (USN-808-1)NessusUbuntu Local Security Checks
medium
27094Solaris 9 (x86) : 114265-23NessusSolaris Local Security Checks
medium
26165Solaris 9 (sparc) : 112837-24NessusSolaris Local Security Checks
medium
25542Solaris 10 (x86) : 119784-40 (deprecated)NessusSolaris Local Security Checks
medium
25541Solaris 10 (sparc) : 119783-40 (deprecated)NessusSolaris Local Security Checks
medium
13429Solaris 8 (x86) : 109327-24NessusSolaris Local Security Checks
critical
13321Solaris 8 (sparc) : 109326-24NessusSolaris Local Security Checks
critical