PT-2014-8680 · Isc+1 · Bind+1

Published 2014-12-11 · Updated 2024-06-15 · CVE-2014-8680

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ISC BIND versions 9.10.0 through 9.10.1

Description The issue is related to the GeoIP functionality, which allows remote attackers to cause a denial of service. This can happen in two scenarios: (1) when there are no GeoIP databases available for both IPv4 and IPv6, or (2) when IPv6 support is enabled with certain options, leading to an assertion failure and the named service exiting.

Recommendations For ISC BIND versions 9.10.0 through 9.10.1, consider disabling the GeoIP functionality as a temporary workaround until a patch is available. Restrict access to the affected service to minimize the risk of exploitation.

Fix

DoS

RCE

Improper Access Control

Weakness Enumeration

CWE-20

CWE-284

Related Identifiers

CVE-2014-8680

OPENSUSE-SU-2024:10467-1

Affected Products

Bind

Bind Server

References · 42

• https://osv.dev/vulnerability/openSUSE-SU-2024:10467-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8680 · Security Note
• https://kb.isc.org/article/AA-01217 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201502-03.xml · Vendor Advisory
• https://suse.com/security/cve/CVE-2015-1349 · Note
• https://suse.com/security/cve/CVE-2011-1910 · Note
• https://suse.com/security/cve/CVE-2012-1667 · Note
• https://suse.com/security/cve/CVE-2009-4022 · Note
• https://suse.com/security/cve/CVE-2012-5688 · Note
• https://suse.com/security/cve/CVE-2013-4854 · Note
• https://suse.com/security/cve/CVE-2015-8705 · Note
• https://suse.com/security/cve/CVE-2010-3614 · Note
• https://suse.com/security/cve/CVE-2016-8864 · Note
• https://suse.com/security/cve/CVE-2014-8680 · Note
• https://suse.com/security/cve/CVE-2015-8000 · Note