About Us | Contact Us

 


 

VUPEN Free Resources

 
  VUPEN Security Advisories
 
  VUPEN Security Blog & News
  Zero-day Attacks Monitor
  Daily Security Mailinglist
  Explanation of Terms
  Advanced Search Engine
 
   

ISC BIND Dynamic Update Message Denial of Service Vulnerability

VUPEN ID VUPEN/ADV-2009-2036
CVE ID CVE-2009-0696
 
CWE ID Available in VUPEN VNS Customer Area
CVSS V2 Available in VUPEN VNS Customer Area
Rated as Moderate Risk 
Impact Available in VUPEN VNS Customer Area
Authentication Level Available in VUPEN VNS Customer Area
Access Vector Available in VUPEN VNS Customer Area
Release Date 2009-07-29
Share Twitter LinkedIn Facebook Delicious Digg Slashdot

Technical Description

A vulnerability has been identified in ISC BIND, which could be exploited by remote attackers to cause a denial of service. This issue is caused due to the "dns_db_findrdataset()" function failing when the prerequisite section of a dynamic update message contains a record of type "ANY" and where at least one RRset for this FQDN exists on the server, which could allow attackers to cause a vulnerable server to exit when receiving a specially crafted dynamic update message sent to a zone for which the server is the master.

Affected Products

ISC BIND versions 9.x

Solution 

Upgrade to ISC BIND version 9.4.3-P3, 9.5.1-P3 or 9.6.1-P1 :
http://ftp.isc.org/isc/bind9/9.6.1-P1/bind-9.6.1-P1.tar.gz
http://ftp.isc.org/isc/bind9/9.5.1-P3/bind-9.5.1-P3.tar.gz
http://ftp.isc.org/isc/bind9/9.4.3-P3/bind-9.4.3-P3.tar.gz

References

http://www.vupen.com/english/advisories/2009/2036
https://www.isc.org/node/474

Credits 

Vulnerability reported by Matthias Urlichs.

Changelog 

2009-07-29 : Initial release

Feedback 

If you have additional information or corrections for this security advisory please submit them via our contact form.

 

Monthly Statistics 

 

 VUPEN Security Advisories By Criticality: Aug 2010


  Critical Risk

: 0%

  High Risk
: 0%

  Moderate Risk
: 0%

  Low Risk
: 100%

Get a real-time view of the vulnerabilities affecting your systems using the VUPEN VNS reporting capabilities.
 

 

Try VUPEN VNS 

 

 





© 2004-2010 VUPEN Security - Copyright - Privacy Policy