Summary: | net-dns/bind: multiple regressions, potential cache poisoning (CVE-2010-{0290,0382}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Stefan Behte (RETIRED) <craig> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | bind+disabled, voxus |
Priority: | High | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | https://www.isc.org/advisories/CVE-2009-4022v6 | ||
Whiteboard: | B3 [glsa] | ||
Package list: | Runtime testing required: | --- | |
Bug Depends on: | |||
Bug Blocks: | 301548 |
Description
Stefan Behte (RETIRED)
2010-03-06 15:22:17 UTC
CVE-2010-0382 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0382): ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022. ping, bind-herd! bind-9.4.3_p4 has been removed, bind-9.4.3_p5 (stable) and bind-9.6.1_p3 are already in tree. going right to glsa status instead of glsa? since it is already drafted GLSA 201006-11 |