PT-2014-1450 · Isc+1 · Isc Bind+1

Publicado 2014-06-13 · Atualizado 2024-06-15 · CVE-2014-3859

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions ISC BIND versions 9.10.0 through 9.10.0 before P2

Description The issue exists due to incorrect handling of EDNS parameters in libdns, part of ISC BIND. This allows remote attackers to cause a denial of service by sending a specially crafted packet, leading to a REQUIRE assertion failure and the termination of the daemon.

Recommendations For versions 9.10.0 through 9.10.0 before P2, update to a version that includes the fix for the EDNS option handling issue to prevent denial of service attacks.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-00413

CVE-2014-3859

OPENSUSE-SU-2024:10467-1

Produtos afetados

Bind Server

Isc Bind

Referências · 47

• https://bdu.fstec.ru/vul/2015-00413 · Nota de Segurança
• https://kb.isc.org/article/AA-01166/0/CVE-2014-3859%3A-BIND-named-can-crash-due-to-a-defect-in-EDNS-printing-processing.html · Nota
• https://suse.com/security/cve/CVE-2016-2776 · Nota
• https://suse.com/security/cve/CVE-2012-3868 · Nota
• https://suse.com/security/cve/CVE-2009-0696 · Nota
• https://suse.com/security/cve/CVE-2012-5688 · Nota
• https://suse.com/security/cve/CVE-2014-3859 · Nota
• https://suse.com/security/cve/CVE-2010-3614 · Nota
• https://suse.com/security/cve/CVE-2009-4022 · Nota
• https://suse.com/security/cve/CVE-2014-0591 · Nota
• https://suse.com/security/cve/CVE-2016-2088 · Nota
• https://suse.com/security/cve/CVE-2012-5689 · Nota
• https://suse.com/security/cve/CVE-2015-8000 · Nota
• https://suse.com/security/cve/CVE-2016-1285 · Nota
• https://suse.com/security/cve/CVE-2011-4313 · Nota