PT-2000-2025 · Isc+1 · Isc Bind+1

Published 2000-12-19 · Updated 2008-09-10 · CVE-2001-0012

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ISC BIND versions 4.9 through 4.9.7 ISC BIND versions 8.1 through 8.2.3 Beta

Description The issue allows remote attackers to access sensitive information such as environment variables. It is also vulnerable to a remotely exploitable buffer overflow in the code that handles Transaction Signatures (TSIG) and a denial of service attack due to improper support of compressed zone transfers (ZXFR). A remote attacker can send an inverse query to the BIND server to access the program stack and view environment variables.

Recommendations For ISC BIND versions 4.9 through 4.9.7, update to a version outside of this range to resolve the issue. For ISC BIND versions 8.1 through 8.2.3 Beta, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the TSIG resource record and disabling compressed zone transfers (ZXFR) until a patch is available. Avoid using the inverse query feature in the affected BIND server until the issue is resolved.

Fix

Related Identifiers

CVE-2001-0012

Affected Products

Bind Server

Isc Bind

References · 11

• http://nai.com/research/covert/advisories/047.asp · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2001-007.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0012 · Security Note
• http://debian.org/security/2001/dsa-026 · Vendor Advisory
• http://cert.org/advisories/CA-2001-02.html · Patch
• http://xforce.iss.net/xforce/xfdb/6018 · Note
• http://securityfocus.com/bid/2321 · Note
• http://securityfocus.com/bid/2302 · Note
• http://securityfocus.com/bid/1923 · Note
• http://xforce.iss.net/xforce/xfdb/6015 · Note
• http://xforce.iss.net/xforce/xfdb/5540 · Note