CERTA-2010-AVI-044
Vulnerability from certfr_avis
Une vulnérabilité dans le logiciel BIND avec DNSSEC permet la corruption du cache DNS.
Description
Le logiciel BIND avec DNSSEC activé ne sauvegarde pas correctement certains enregistrements dans son cache. Ce dysfonctionnement apparait lorsque le client DNS effectue des requêtes DNSSEC (DO) sans vérification (CD). Cette vulnérabilité avait déjà été traitée dans l'avis CERTA-2009-AVI-515, mais le correctif s'est révélé insuffisant.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
Vendor | Product | Description | ||
---|---|---|---|---|
ISC | BIND | BIND versions 9.5.x antérieures à 9.5.2-P2 ; | ||
ISC | BIND | BIND versions 9.6.x antérieures à 9.6.1-P3 ; | ||
ISC | BIND | BIND versions 9.0.x ; | ||
ISC | BIND | BIND versions 9.3.x ; | ||
ISC | BIND | BIND versions 9.1.x ; | ||
ISC | BIND | BIND versions 9.2.x ; | ||
ISC | BIND | BIND version 9.7.0 beta. | ||
ISC | BIND | BIND versions 9.4.x antérieures à 9.4.3-P5 ; |
References
Title | Publication Time | Tags | |
---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "BIND versions 9.5.x ant\u00e9rieures \u00e0 9.5.2-P2 ;", "product": { "name": "BIND", "vendor": { "name": "ISC", "scada": false } } }, { "description": "BIND versions 9.6.x ant\u00e9rieures \u00e0 9.6.1-P3 ;", "product": { "name": "BIND", "vendor": { "name": "ISC", "scada": false } } }, { "description": "BIND versions 9.0.x ;", "product": { "name": "BIND", "vendor": { "name": "ISC", "scada": false } } }, { "description": "BIND versions 9.3.x ;", "product": { "name": "BIND", "vendor": { "name": "ISC", "scada": false } } }, { "description": "BIND versions 9.1.x ;", "product": { "name": "BIND", "vendor": { "name": "ISC", "scada": false } } }, { "description": "BIND versions 9.2.x ;", "product": { "name": "BIND", "vendor": { "name": "ISC", "scada": false } } }, { "description": "BIND version 9.7.0 beta.", "product": { "name": "BIND", "vendor": { "name": "ISC", "scada": false } } }, { "description": "BIND versions 9.4.x ant\u00e9rieures \u00e0 9.4.3-P5 ;", "product": { "name": "BIND", "vendor": { "name": "ISC", "scada": false } } } ], "affected_systems_content": null, "content": "## Description\n\nLe logiciel BIND avec DNSSEC activ\u00e9 ne sauvegarde pas correctement\ncertains enregistrements dans son cache. Ce dysfonctionnement apparait\nlorsque le client DNS effectue des requ\u00eates DNSSEC (DO) sans\nv\u00e9rification (CD). Cette vuln\u00e9rabilit\u00e9 avait d\u00e9j\u00e0 \u00e9t\u00e9 trait\u00e9e dans\nl\u0027avis CERTA-2009-AVI-515, mais le correctif s\u0027est r\u00e9v\u00e9l\u00e9 insuffisant.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n", "cves": [ { "name": "CVE-2009-4022", "url": "https://www.cve.org/CVERecord?id=CVE-2009-4022" }, { "name": "CVE-2010-0290", "url": "https://www.cve.org/CVERecord?id=CVE-2010-0290" } ], "initial_release_date": "2010-02-02T00:00:00", "last_revision_date": "2010-07-29T00:00:00", "links": [ { "title": "Bulletin de s\u00e9curit\u00e9 de l\u0027ISC du 23 novembre 2009, mis \u00e0 jour le 19 janvier :", "url": "https://www.isc.org/node/504" }, { "title": "Bulletin de s\u00e9curit\u00e9 IBM du 26 juillet 2010 :", "url": "http://aix.software.ibm.com/aix/efixes/security/bind9_advisory.asc" }, { "title": "Document du CERTA CERTA-2009-AVI-515 du 26 novembre 2009 :", "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2009-AVI-515/index.html" } ], "reference": "CERTA-2010-AVI-044", "revisions": [ { "description": "version initiale.", "revision_date": "2010-02-02T00:00:00.000000" }, { "description": "ajout de la r\u00e9f\u00e9rence au bulletin IBM.", "revision_date": "2010-07-29T00:00:00.000000" } ], "risks": [ { "description": "Contournement de la politique de s\u00e9curit\u00e9" } ], "summary": "Une vuln\u00e9rabilit\u00e9 dans le logiciel BIND avec DNSSEC permet la corruption\ndu cache DNS.\n", "title": "Vuln\u00e9rabilit\u00e9 dans BIND avec DNSSEC", "vendor_advisories": [ { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 de l\u0027ISC du 23 novembre 2009, mis \u00e0 jour le 19 janvier 2010", "url": null } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…