Dhiru Kholia

**Name of the Vulnerable Software and Affected Versions** eapmd5pass version 1.4 **Description** A flaw was found in the way eapmd5pass handled processing of network packets, related to the assess packet function in eapmd5pass.c. This issue could allow a remote attacker to crash the eapmd5pass process under certain circumstances by generating specially crafted network traffic. **Recommendations** For eapmd5pass version 1.4, consider restricting access to the assess packet function until a patch is available. As a temporary workaround, avoid using the eapmd5pass process to handle network packets from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** eapmd5pass version 1.4 **Description** A flaw was found in the way eapmd5pass handled processing of network packets, related to the assess packet function in eapmd5pass.c. This issue could allow a remote attacker to crash the eapmd5pass process under certain circumstances by generating specially crafted network traffic. **Recommendations** For version 1.4, consider restricting access to the assess packet function until a patch is available. As a temporary workaround, avoid using the eapmd5pass process to handle network packets from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** eapmd5pass version 1.4 **Description** A length validation flaw was found in the way eapmd5pass handled network traffic in the `extract eapusername` function, potentially leading to out-of-bounds read and write. This could allow a remote attacker to crash the eapmd5pass process by generating specially crafted network traffic. **Recommendations** For eapmd5pass version 1.4, consider restricting access to the `extract eapusername` function until a patch is available. As a temporary workaround, network traffic should be carefully validated to prevent specially crafted packets from reaching the eapmd5pass process.

**Name of the Vulnerable Software and Affected Versions** BIND (affected versions not specified) **Description** A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ISC BIND versions 9.1.0 through 9.8.4-P2 ISC BIND versions 9.9.0 through 9.9.2-P2 **Description** The issue allows remote attackers to cause a denial of service, resulting in an assertion failure and daemon exit, by sending a specially crafted DNS packet with malformed options data in an OPT resource record. **Recommendations** For versions 9.1.0 through 9.8.4-P2, update to a version later than 9.8.4-P2 to resolve the issue. For versions 9.9.0 through 9.9.2-P2, update to a version later than 9.9.2-P2 to resolve the issue. As a temporary workaround, consider restricting access to the DNS service to minimize the risk of exploitation.