PT-2010-5635 · Isc+3 · Liblwres50+7

Published 1970-01-01 · Updated 2018-10-10 · CVE-2010-3762

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions ISC BIND versions prior to 9.7.2-P2 libisccc50 (affected versions not specified) libisccfg50 (affected versions not specified) liblwres50 (affected versions not specified) libdns58 (affected versions not specified)

Description The issue concerns multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including ISC BIND, which can lead to disruption of integrity and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, when DNSSEC validation is enabled in ISC BIND, it does not properly handle certain bad signatures if multiple trust anchors exist for a single zone, allowing remote attackers to cause a denial of service via a DNS query.

Recommendations For ISC BIND versions prior to 9.7.2-P2, update to version 9.7.2-P2 or later to resolve the issue. For libisccc50, libisccfg50, liblwres50, and libdns58, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

CWE-264

Related Identifiers

BDU:2015-01437

BDU:2015-01438

BDU:2015-01439

BDU:2015-01440

BDU:2015-01441

BDU:2015-01442

CVE-2010-3762

DSA-2130-1

RHSA-2010:0976

RHSA-2010_0976

Affected Products

Bind Server

Debian

Isc Bind

Red Hat

Libdns58

Libisccc50

Libisccfg50

Liblwres50

References · 28

• https://security-tracker.debian.org/tracker/CVE-2010-3762 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-3762 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3613 · Security Note
• http://redhat.com/support/errata/RHSA-2010-0976.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3614 · Security Note
• https://bdu.fstec.ru/vul/2015-01440 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-3762 · Security Note
• https://bdu.fstec.ru/vul/2015-01437 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2010:253 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3762 · Security Note
• https://bdu.fstec.ru/vul/2015-01438 · Security Note
• https://bdu.fstec.ru/vul/2015-01441 · Security Note
• https://bdu.fstec.ru/vul/2015-01442 · Security Note
• http://debian.org/security/2010/dsa-2130 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01439 · Security Note