PT-2012-3031 · Isc+4 · Isc Bind 9+4

Haixin Duan + 6 · Published 2012-02-08 · Updated 2024-05-13 · CVE-2012-1033

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ISC BIND 9 versions 9.1.1 through 9.8.1-P1 ISC BIND 9 version 9.7.0 ISC BIND 9 version 9.7.2

Description The issue allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. This occurs because the resolver in ISC BIND 9 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query. The estimated number of potentially affected devices is not specified. However, the issue has been leveraged for DNS tunneling in various campaigns, including those by Darkhydrus, Oilrig, and Cobalt katana, targeting educational institutions, network infrastructure, and cloud environments across APAC, America, EMEA, and Japan.

Recommendations For ISC BIND 9 versions 9.1.1 through 9.8.1-P1, consider updating to a version that is not affected by this issue. For ISC BIND 9 version 9.7.0, consider updating to a version that is not affected by this issue. For ISC BIND 9 version 9.7.2, consider updating to a version that is not affected by this issue. As a temporary workaround, consider restricting the use of the resolver function to minimize the risk of exploitation.

Fix

Related Identifiers

CESA-2012_0716

CVE-2012-1033

HPSBUX02835

RHSA-2012:0716

RHSA-2012:0717

RHSA-2012_0716

RHSA-2012_0717

Affected Products

Bind Server

Centos

Hp-Ux

Isc Bind 9

Red Hat

References · 29

• http://rhn.redhat.com/errata/RHSA-2012-0717.html · Vendor Advisory
• https://hermes.opensuse.org/messages/15136456 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-1033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1033 · Security Note
• https://osv.dev/vulnerability/CVE-2012-1033 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1033 · Security Note
• https://hermes.opensuse.org/messages/15136477 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=135638082529878&w=2 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2012-0716.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1667 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1033 · Vendor Advisory
• https://isc.org/software/bind/advisories/cve-2012-1033 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2012-1033 · Note
• https://t.me/aptreports/9731 · Telegram Post
• https://access.redhat.com/errata/RHSA-2012:0716 · Note