PT-2010-5659 · Isc+2 · Isc Bind+2

Published 1970-01-01 · Updated 2017-09-19 · CVE-2010-0382

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ISC BIND versions 9.0.x through 9.3.x ISC BIND version 9.4 before 9.4.3-P5 ISC BIND version 9.5 before 9.5.2-P2 ISC BIND version 9.6 before 9.6.1-P3 ISC BIND version 9.7.0 beta

Description The issue allows remote attackers to have an unspecified impact via a crafted response. This is due to the handling of out-of-bailiwick data accompanying a secure response without re-fetching from the original source. Exploitation of the vulnerabilities can lead to disruption of confidentiality, integrity, and availability of protected information and can be carried out remotely.

Recommendations For ISC BIND versions 9.0.x through 9.3.x, update to a version outside of this range to mitigate the risk. For ISC BIND version 9.4 before 9.4.3-P5, update to version 9.4.3-P5 or later. For ISC BIND version 9.5 before 9.5.2-P2, update to version 9.5.2-P2 or later. For ISC BIND version 9.6 before 9.6.1-P3, update to version 9.6.1-P3 or later. For ISC BIND version 9.7.0 beta, avoid using this version until a stable release is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-02888

BDU:2015-02889

CVE-2010-0382

DSA-2054-1

RHSA-2010:0062

RHSA-2010_0062

Affected Products

Bind Server

Isc Bind

Red Hat

References · 23

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0382 · Security Note
• https://bdu.fstec.ru/vul/2015-02889 · Security Note
• https://bdu.fstec.ru/vul/2015-02888 · Security Note
• http://debian.org/security/2010/dsa-2054 · Vendor Advisory
• https://isc.org/advisories/CVE-2009-4022v6 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-0382 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0097 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-0382 · Security Note
• https://osv.dev/vulnerability/CVE-2010-0382 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-0382 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0290 · Security Note
• http://secunia.com/advisories/40086 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7086 · Note
• https://access.redhat.com/security/cve/CVE-2010-0290 · Note
• https://access.redhat.com/security/cve/CVE-2010-0097 · Note