PT-2002-2195 · Isc+1 · Bind+1
Publicado
2002-11-29
·
Atualizado
2018-05-03
·
CVE-2002-1219
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
BIND 4 versions 4.9.10 and earlier
BIND 8 versions 8.3.3 and earlier
Description:
The issue allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records. It has been reported that DNS servers running with recursive DNS functionality enabled are prone to a buffer overflow condition. An attacker-controlled authoritative DNS server may cause the software to cache information into an internal database when recursion is enabled. A buffer overflow exists when the DNS server constructs a response to a client request for cached information, which could result in the execution of arbitrary attacker-supplied code with the privileges of the vulnerable daemon.
Recommendations:
For BIND 4 versions 4.9.10 and earlier, update to a version later than 4.9.10 to resolve the issue.
For BIND 8 versions 8.3.3 and earlier, update to a version later than 8.3.3 to resolve the issue.
As a temporary workaround, consider disabling the recursive DNS functionality until a patch is available.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Bind
Bind Server