PT-2014-8563 · Isc+9 · Isc Bind+9

Publicado 2014-12-09 · Atualizado 2024-06-15 · CVE-2014-8500

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ISC BIND versions 9.0.x through 9.8.x ISC BIND versions 9.9.0 through 9.9.6 ISC BIND versions 9.10.0 through 9.10.1

Description The issue allows remote attackers to cause a denial of service, resulting in memory consumption and named crash, via a large or infinite number of referrals due to the lack of limits on delegation chaining.

Recommendations For versions 9.0.x through 9.8.x, update to a version that limits delegation chaining to prevent denial of service attacks. For versions 9.9.0 through 9.9.6, update to a version that limits delegation chaining to prevent denial of service attacks. For versions 9.10.0 through 9.10.1, update to a version that limits delegation chaining to prevent denial of service attacks.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

ALT-PU-2015-1641

CESA-2014_1984

CVE-2014-8500

DLA-112-1

DSA-3094-1

HPSBUX03235

HPSBUX03400

MGASA-2014-0524

OPENSUSE-SU-2024:10467-1

RHSA-2014:1984

RHSA-2014:1985

RHSA-2014_1984

RHSA-2014_1985

RHSA-2016:0078

SUSE-SU-2015:0011-2

SUSE-SU-2015:0480-1

SUSE-SU-2015:1205-1

SUSE-SU-2015_0011-1

SUSE-SU-2015_0011-2

SUSE-SU-2015_0096-1

SUSE-SU-2015_0488-1

USN-2437-1

Produtos afetados

Alt Linux

Bind Server

Centos

Hp-Ux

Ibm Aix

Isc Bind

Junos

Red Hat

Suse

Ubuntu

Referências · 127

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/dns/bind_tkey.rb · Exploit
• 🔥 https://github.com/robertdavidgraham/cve-2015-5477 · Exploit
• 🔥 https://github.com/elceef/tkeypoc · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1349 · Nota de Segurança
• http://secunia.com/advisories/62064 · Nota
• https://suse.com/security/cve/CVE-2012-5166 · Nota
• https://suse.com/security/cve/CVE-2015-8705 · Nota
• https://suse.com/security/cve/CVE-2009-4022 · Nota
• https://lists.suse.com/pipermail/sle-security-updates/2015-January/001144.html · Nota
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00017.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2014:1985 · Nota
• https://bdu.fstec.ru/vul/2015-12237 · Nota de Segurança
• https://kb.isc.org/article/AA-01216 · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2014-December/082989.html · Nota
• http://advisories.mageia.org/MGASA-2014-0524.html · Nota