CVE-2010-0097

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta does not properly validate DNSSEC (1) NSEC and (2) NSEC3 records, which allows remote attackers to add the Authenticated Data (AD) flag to a forged NXDOMAIN response for an existing domain.

References

ftp://ftp.sco.com/pub/unixware7/714/security/p535243_uw7/p535243b.txt

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034196.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034202.html

http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html

http://marc.info/?l=bugtraq&m=127195582210247&w=2

http://secunia.com/advisories/38169

http://secunia.com/advisories/38219

http://secunia.com/advisories/38240

http://secunia.com/advisories/39334

http://secunia.com/advisories/39582

http://secunia.com/advisories/40086

http://securitytracker.com/id?1023474

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021798.1-1

http://support.apple.com/kb/HT5002

http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0018

http://www.debian.org/security/2010/dsa-2054

http://www.kb.cert.org/vuls/id/360341

http://www.mandriva.com/security/advisories?name=MDVSA-2010:021

http://www.osvdb.org/61853

http://www.securityfocus.com/bid/37865

http://www.ubuntu.com/usn/USN-888-1

http://www.vupen.com/english/advisories/2010/0176

http://www.vupen.com/english/advisories/2010/0622

http://www.vupen.com/english/advisories/2010/0981

http://www.vupen.com/english/advisories/2010/1352

https://bugzilla.redhat.com/show_bug.cgi?id=554851

https://exchange.xforce.ibmcloud.com/vulnerabilities/55753

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12205

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7212

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7430

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9357

https://rhn.redhat.com/errata/RHSA-2010-0062.html

https://rhn.redhat.com/errata/RHSA-2010-0095.html

https://www.isc.org/advisories/CVE-2010-0097

Details

Source: MITRE

Published: 2010-01-22

Updated: 2017-09-19

Type: CWE-20

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:isc:bind:9.0:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.0.0:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.0.0:rc3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.0.0:rc4:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.0.0:rc5:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.0.0:rc6:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.0.1:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.0.1:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.0.1:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.0:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.1:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.1:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.1:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.1:rc3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.1:rc4:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.1:rc5:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.1:rc6:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.1:rc7:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.2:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.2:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.3:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.3:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.3:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.1.3:rc3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:a1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:a2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:a3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:b1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:b2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:rc10:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:rc3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:rc4:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:rc5:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:rc6:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:rc7:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:rc8:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.0:rc9:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.1:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.1:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.1:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.2:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.2:p2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.2:p3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.2:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.3:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.3:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.3:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.3:rc3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.3:rc4:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.4:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.4:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.4:rc3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.4:rc4:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.4:rc5:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.4:rc6:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.4:rc7:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.4:rc8:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.5:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.5:b2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.5:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.6:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.6:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.7:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.7:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.7:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.7:rc3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.8:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.9:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.2.9:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.0:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.0:b2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.0:b3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.0:b4:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.0:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.0:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.0:rc3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.0:rc4:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.1:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.1:b2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.1:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.2:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.2:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.3:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.3:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.3:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.3:rc3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.4:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.5:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.5:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.5:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.6:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.3.6:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4:*:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.4:b1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.4:r1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.4:r2:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.4:r3:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.4:r4:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.4:r4-p1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.4:r5:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.4:r5-b1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.4:r5-p1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.4:r5-rc1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.4.0:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:a1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:a2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:a3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:a4:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:a5:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:a6:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:b1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:b2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:b3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:b4:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.0:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.1:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.2:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.2:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.2:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.3:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.3:b1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.3:b2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.3:b3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.3:p2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.4.3:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a4:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a5:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a6:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:a7:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:b1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:b2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:b3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:p1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:p2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:p2_w1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:p2_w2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.0:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.1:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.1:b1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.1:b2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.1:b3:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.1:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.1:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.2:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.2:b1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.5.2:p1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6:*:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r2:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r3:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r4:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r4_p1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r5:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r5_b1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r5_p1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r6:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r6_b1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r6_rc1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r6_rc2:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r7:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r7_p1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r7_p2:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r9:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6:r9_p1:*:*:esv:*:*:*

cpe:2.3:a:isc:bind:9.6.0:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.0:a1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.0:b1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.0:p1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.0:rc1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.0:rc2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.1:*:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.1:b1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.1:p1:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.6.1:p2:*:*:*:*:*:*

cpe:2.3:a:isc:bind:9.7.0:*:*:*:*:*:*:*

Tenable Plugins

View all (29 total)

IDNameProductFamilySeverity
137170OracleVM 3.3 / 3.4 : bind (OVMSA-2020-0021)NessusOracleVM Local Security Checks
high
99569OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0066)NessusOracleVM Local Security Checks
high
89740VMware ESX / ESXi Third-Party Libraries and Components (VMSA-2010-0009) (remote check)NessusVMware ESX Local Security Checks
critical
85131F5 Networks BIG-IP : BIND DNSSEC vulnerability (SOL17025)NessusF5 Networks Local Security Checks
medium
67991Oracle Linux 5 : bind (ELSA-2010-0062)NessusOracle Linux Local Security Checks
high
63707AIX 7.1 TL 0 : bind9 (IV11744)NessusAIX Local Security Checks
high
63706AIX 6.1 TL 6 : bind9 (IV11743)NessusAIX Local Security Checks
high
63705AIX 6.1 TL 5 : bind9 (IV11742)NessusAIX Local Security Checks
high
63701AIX 7.1 TL 1 : bind9 (IV10049)NessusAIX Local Security Checks
high
63700AIX 6.1 TL 7 : bind9 (IV09978)NessusAIX Local Security Checks
high
63699AIX 5.3 TL 12 : bind9 (IV09491)NessusAIX Local Security Checks
high
60726Scientific Linux Security Update : bind on SL5.x i386/x86_64NessusScientific Linux Local Security Checks
medium
56481Mac OS X Multiple Vulnerabilities (Security Update 2011-006)NessusMacOS X Local Security Checks
critical
54879Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 8.1 / 9.0 / 9.1 / current : bind (SSA:2010-176-01)NessusSlackware Local Security Checks
medium
47200Fedora 12 : bind-9.6.1-15.P3.fc12 (2010-0868)NessusFedora Local Security Checks
medium
47199Fedora 11 : bind-9.6.1-9.P3.fc11 (2010-0861)NessusFedora Local Security Checks
medium
46829Debian DSA-2054-1 : bind9 - DNS cache poisoningNessusDebian Local Security Checks
high
46778GLSA-201006-11 : BIND: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
46765VMSA-2010-0009 : ESXi ntp and ESX Service Console third-party updatesNessusVMware ESX Local Security Checks
high
44311SuSE 11 Security Update : bind (SAT Patch Number 1844)NessusSuSE Local Security Checks
medium
44309openSUSE Security Update : bind (bind-1845)NessusSuSE Local Security Checks
medium
44307openSUSE Security Update : bind (bind-1845)NessusSuSE Local Security Checks
medium
44305openSUSE Security Update : bind (bind-1843)NessusSuSE Local Security Checks
medium
44116ISC BIND 9 DNSSEC NSEC/NSEC3 Bogus NXDOMAIN ResponsesNessusDNS
medium
44106Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : bind9 vulnerabilities (USN-888-1)NessusUbuntu Local Security Checks
medium
44105RHEL 5 : bind (RHSA-2010:0062)NessusRed Hat Local Security Checks
high
44102Mandriva Linux Security Advisory : bind (MDVSA-2010:021)NessusMandriva Local Security Checks
high
44099CentOS 5 : bind (CESA-2010:0062)NessusCentOS Local Security Checks
high
5323ISC BIND 9 DNSSEC Bogus NXDOMAIN Response Remote Cache PoisoningNessus Network MonitorDNS Servers
medium