PT-2014-1450 · Isc+1 · Isc Bind+1

Published 2014-06-13 · Updated 2024-06-15 · CVE-2014-3859

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions ISC BIND versions 9.10.0 through 9.10.0 before P2

Description The issue exists due to incorrect handling of EDNS parameters in libdns, part of ISC BIND. This allows remote attackers to cause a denial of service by sending a specially crafted packet, leading to a REQUIRE assertion failure and the termination of the daemon.

Recommendations For versions 9.10.0 through 9.10.0 before P2, update to a version that includes the fix for the EDNS option handling issue to prevent denial of service attacks.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-00413

CVE-2014-3859

OPENSUSE-SU-2024:10467-1

Affected Products

Bind Server

Isc Bind

References · 47

• https://bdu.fstec.ru/vul/2015-00413 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-3859 · Security Note
• https://kb.isc.org/article/AA-01166 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3859 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10467-1 · Vendor Advisory
• https://kb.isc.org/article/AA-01166/0/CVE-2014-3859%3A-BIND-named-can-crash-due-to-a-defect-in-EDNS-printing-processing.html · Note
• https://suse.com/security/cve/CVE-2016-2776 · Note
• https://suse.com/security/cve/CVE-2012-3868 · Note
• https://suse.com/security/cve/CVE-2009-0696 · Note
• https://suse.com/security/cve/CVE-2012-5688 · Note
• https://suse.com/security/cve/CVE-2014-3859 · Note
• https://suse.com/security/cve/CVE-2010-3614 · Note
• https://suse.com/security/cve/CVE-2009-4022 · Note
• https://suse.com/security/cve/CVE-2014-0591 · Note
• https://suse.com/security/cve/CVE-2016-2088 · Note