PT-2005-1157 · Isc+1 · Bind+1

Joao Damas · Published 2005-01-29 · Updated 2017-07-11 · CVE-2005-0033

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions BIND versions 8.4.4 through 8.4.5

Description A buffer overflow issue exists in the code for recursion and glue fetching, allowing remote attackers to cause a denial of service by crashing the system via queries that trigger the overflow in the q usedns array, which tracks nameservers and addresses.

Recommendations For BIND versions 8.4.4 through 8.4.5, consider restricting access to the recursion and glue fetching functionality until a patch is available. As a temporary workaround, limit the use of the q usedns array to prevent the buffer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-0033

Affected Products

Bind

Bind Server

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2005-0033 · Security Note
• http://uniras.gov.uk/niscc/docs/al-20050125-00059.html · Patch
• http://isc.org/index.pl?/sw/bind/bind-security.php · Patch
• ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.1/SCOSA-2006.1.txt · Vendor Advisory
• http://isc.org/index.pl?/sw/bind/bind8.php · Patch
• http://securityfocus.com/bid/12364 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19063 · Note
• http://secunia.com/advisories/14009 · Note
• http://secunia.com/advisories/18291 · Note
• http://securitytracker.com/id?1012996 · Note
• http://kb.cert.org/vuls/id/327633 · Note