PT-2009-5884 · Nlnet · Unbound

Florian Weimer · Publicado 2009-10-13 · Atualizado 2017-08-17 · CVE-2009-3602

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Unbound versions prior to 1.3.4

Description The issue concerns the improper verification of signatures for NSEC3 records, allowing remote attackers to downgrade secure delegations via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.

Recommendations For versions prior to 1.3.4, update to version 1.3.4 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2009-3602

DSA-1963-1

Produtos afetados

Unbound

Referências · 13

• https://security-tracker.debian.org/tracker/CVE-2009-3602 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-3602 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2009-3602 · Aviso do Fabricante
• http://unbound.net/pipermail/unbound-users/2009-October/000852.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2009/10/09/3 · Nota
• http://secunia.com/advisories/36996 · Aviso do Fabricante
• http://debian.org/security/2009/dsa-1963 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2009/10/09/2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53729 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3602 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/2875 · Aviso do Fabricante
• http://osvdb.org/58836 · Nota
• http://secunia.com/advisories/37913 · Nota