PT-2014-3695 · Isc+6 · Isc Bind+6

Published 2014-01-14 · Updated 2024-06-15 · CVE-2014-0591

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions ISC BIND versions 9.6 through 9.8 before 9.8.6-P2 ISC BIND versions 9.9 before 9.9.4-P2 ISC BIND 9.6-ESV before 9.6-ESV-R10-P2

Description The issue allows remote attackers to cause a denial of service via a crafted DNS query to an authoritative nameserver that uses the NSEC3 signing feature. This is due to a problem in the query findclosestnsec3 function.

Recommendations For ISC BIND versions 9.6 through 9.8 before 9.8.6-P2, update to version 9.8.6-P2 or later. For ISC BIND versions 9.9 before 9.9.4-P2, update to version 9.9.4-P2 or later. For ISC BIND 9.6-ESV before 9.6-ESV-R10-P2, update to version 9.6-ESV-R10-P2 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2014-1137

CESA-2014_0043

CVE-2014-0591

DLA-48-1

DSA-3023-1

HPSBUX02961

MGASA-2014-0013

OPENSUSE-SU-2024:10467-1

RHSA-2014:0043

RHSA-2014:1244

RHSA-2014_0043

RHSA-2014_1244

SUSE-SU-2014_0179-1

SUSE-SU-2015:0011-2

SUSE-SU-2015:0480-1

SUSE-SU-2015:1205-1

SUSE-SU-2015_0480-1

Affected Products

Alt Linux

Bind Server

Centos

Hp-Ux

Isc Bind

Red Hat

Suse

References · 105

• https://advisories.mageia.org/MGASA-2014-0013.html · Security Note
• https://kb.isc.org/article/AA-01085 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126772.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-0591 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.524465 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-1137 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126761.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10467-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0591 · Security Note
• https://osv.dev/vulnerability/CVE-2014-0591 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-02/msg00019.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0591 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0591 · Security Note
• http://debian.org/security/2014/dsa-3023 · Vendor Advisory
• http://freebsd.org/security/advisories/FreeBSD-SA-14:04.bind.asc · Vendor Advisory