PT-2009-2933 · Isc · Bind

Published 2009-01-26 · Updated 2024-02-13 · CVE-2009-0265

Mitre

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077 and CVE-2009-0025.

Fix

Unchecked Return Value

Improper Certificate Validation

Weakness Enumeration

CWE-252

CWE-295

Related Identifiers

CVE-2009-0265

Affected Products

Bind

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2009-0265 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:037 · Vendor Advisory
• https://isc.org/node/373 · Vendor Advisory
• http://secunia.com/advisories/33559 · Vendor Advisory
• http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33 · Note
• http://vupen.com/english/advisories/2009/0043 · Note
• http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.540362 · Patch, Vendor Advisory