PT-2010-5634 · Isc+3 · Libdns58+9

Published 1970-01-01 · Updated 2024-06-15 · CVE-2010-3614

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions ISC BIND 9.x versions prior to 9.6.2-P3 ISC BIND 9.x versions prior to 9.7.2-P3 ISC BIND 9.4-ESV versions prior to 9.4-ESV-R4 ISC BIND 9.6-ESV versions prior to 9.6-ESV-R3 libdns58 (affected versions not specified) libisccc50 (affected versions not specified) libisccfg50 (affected versions not specified) libisc50 (affected versions not specified) liblwres50 (affected versions not specified) lwresd (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the mentioned packages of the Debian GNU/Linux operating system, which can lead to a disruption of the integrity and availability of protected information. These vulnerabilities can be exploited remotely. Additionally, there is an issue with the named service in ISC BIND 9.x, where it does not properly determine the security status of an NS RRset during a DNSKEY algorithm rollover, potentially allowing remote attackers to cause a denial of service by triggering a rollover.

Recommendations For ISC BIND 9.x versions prior to 9.6.2-P3, update to version 9.6.2-P3 or later. For ISC BIND 9.x versions prior to 9.7.2-P3, update to version 9.7.2-P3 or later. For ISC BIND 9.4-ESV versions prior to 9.4-ESV-R4, update to version 9.4-ESV-R4 or later. For ISC BIND 9.6-ESV versions prior to 9.6-ESV-R3, update to version 9.6-ESV-R3 or later. For libdns58, libisccc50, libisccfg50, libisc50, liblwres50, and lwresd, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

CWE-264

Related Identifiers

BDU:2015-01437

BDU:2015-01438

BDU:2015-01439

BDU:2015-01440

BDU:2015-01441

BDU:2015-01442

CVE-2010-3614

DSA-2130-1

OPENSUSE-SU-2024:10467-1

RHSA-2010:0975

RHSA-2010:0976

RHSA-2010_0975

RHSA-2010_0976

Affected Products

Bind Server

Debian

Isc Bind 9.X

Red Hat

Libdns58

Libisc50

Libisccc50

Libisccfg50

Liblwres50

Lwresd

References · 89

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3614 · Security Note
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3614 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3762 · Security Note
• https://bdu.fstec.ru/vul/2015-01441 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10467-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2010-0975.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1025-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-3614 · Vendor Advisory
• http://vupen.com/english/advisories/2010/3103 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3614 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051910.html · Vendor Advisory
• http://vupen.com/english/advisories/2010/3138 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.622190 · Vendor Advisory
• http://vupen.com/english/advisories/2010/3102 · Vendor Advisory