PT-2009-5884 · Nlnet · Unbound

Florian Weimer · Published 2009-10-13 · Updated 2017-08-17 · CVE-2009-3602

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Unbound versions prior to 1.3.4

Description The issue concerns the improper verification of signatures for NSEC3 records, allowing remote attackers to downgrade secure delegations via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.

Recommendations For versions prior to 1.3.4, update to version 1.3.4 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2009-3602

DSA-1963-1

Affected Products

Unbound

References · 13

• https://security-tracker.debian.org/tracker/CVE-2009-3602 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3602 · Security Note
• https://osv.dev/vulnerability/CVE-2009-3602 · Vendor Advisory
• http://unbound.net/pipermail/unbound-users/2009-October/000852.html · Vendor Advisory
• http://secunia.com/advisories/36996 · Vendor Advisory
• http://debian.org/security/2009/dsa-1963 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3602 · Vendor Advisory
• http://vupen.com/english/advisories/2009/2875 · Vendor Advisory
• http://openwall.com/lists/oss-security/2009/10/09/3 · Note
• http://openwall.com/lists/oss-security/2009/10/09/2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53729 · Note
• http://osvdb.org/58836 · Note
• http://secunia.com/advisories/37913 · Note