PT-2005-1158 · Isc+1 · Bind+1

Joao Damas · Publicado 2005-01-29 · Atualizado 2017-07-11 · CVE-2005-0034

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions BIND version 9.3.0

Description The issue is caused by an "incorrect assumption" in the authvalidated validator function when DNSSEC is enabled. This allows remote attackers to cause a denial of service, resulting in the named server exiting, by sending crafted DNS packets that cause an internal consistency test to fail.

Recommendations For BIND version 9.3.0, consider disabling DNSSEC until a patch is available to prevent the denial of service. Additionally, restrict access to the authvalidated validator function to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-0034

Produtos afetados

Bind

Bind Server

Referências · 13

• http://isc.org/index.pl?/sw/bind/bind-security.php · Correção
• http://securityfocus.com/bid/12365 · Nota
• https://security-tracker.debian.org/tracker/CVE-2005-0034 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0034 · Aviso do Fabricante
• http://securitytracker.com/id?1012995 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19062 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0034 · Nota de Segurança
• http://uniras.gov.uk/niscc/docs/al-20050125-00060.html · Correção
• http://isc.org/index.pl?/sw/bind/bind9.php · Nota
• http://kb.cert.org/vuls/id/938617 · Correção
• https://osv.dev/vulnerability/CVE-2005-0034 · Aviso do Fabricante
• http://trustix.org/errata/2005/0003 · Aviso do Fabricante
• http://secunia.com/advisories/14008 · Nota