PT-2009-2933 · Isc · Bind

CVE-2009-0265 · Publicado 2009-01-26 · Atualizado 2024-02-13

Mitre

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077 and CVE-2009-0025.

Correção

Unchecked Return Value

Improper Certificate Validation

Enumeração de Fraquezas

CWE-252

CWE-295

Identificadores relacionados

CVE-2009-0265

Produtos afetados

Bind

Referências · 7

• http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0265 · Nota de Segurança
• http://mandriva.com/security/advisories?name=MDVSA-2009:037 · Aviso do Fabricante
• https://isc.org/node/373 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/0043 · Nota
• http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.540362 · Correção, Aviso do Fabricante
• http://secunia.com/advisories/33559 · Aviso do Fabricante