PT-2006-4938 · Isc+1 · Bind+1

Joao Damas · Published 2006-09-05 · Updated 2024-02-15 · CVE-2006-4095

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BIND versions 9.2.x through 9.2.6 and 9.3.x through 9.3.2

Description The issue allows a remote attacker to cause a denial of service (crash) via certain SIG queries, which cause an assertion failure when multiple RRsets are returned.

Recommendations For versions 9.2.x through 9.2.6, update to version 9.2.6-P1 or later. For versions 9.3.x through 9.3.2, update to version 9.3.2-P1 or later.

Fix

DoS

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2006-4095

DSA-1172-1

Affected Products

Bind

Bind Server

References · 45

• http://security.gentoo.org/glsa/glsa-200609-11.xml · Vendor Advisory
• http://ubuntu.com/usn/usn-343-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4095 · Security Note
• https://osv.dev/vulnerability/CVE-2006-4095 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_24_sr.html · Vendor Advisory
• http://us.debian.org/security/2006/dsa-1172 · Vendor Advisory
• http://security.freebsd.org/advisories/FreeBSD-SA-06:20.bind.asc · Vendor Advisory
• https://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2007/May/msg00004.html · Vendor Advisory
• http://openbsd.org/errata.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-4095 · Vendor Advisory
• http://openpkg.com/security/advisories/OpenPKG-SA-2006.019.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-4095 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.481241 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:163 · Vendor Advisory