Published: 05/06/2012 Updated: 18/01/2018

CVSS v2 Base Score: 8.5 | Impact Score: 7.8 | Exploitability Score: 10

VMScore: 865

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:C

ISC BIND 9.x prior to 9.7.6-P1, 9.8.x prior to 9.8.3-P1, 9.9.x prior to 9.9.1-P1, and 9.4-ESV and 9.6-ESV prior to 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.

Vulnerable Product	Search on Vulmon	Subscribe to Product
isc bind 9.9.0
isc bind 9.7.6
isc bind 9.7.4
isc bind 9.7.3
isc bind 9.7.2
isc bind 9.7.0
isc bind 9.6.3
isc bind 9.6.2
isc bind 9.6.0
isc bind 9.6
isc bind 9.5.3
isc bind 9.5.2
isc bind 9.5.1
isc bind 9.5.0
isc bind 9.4.3
isc bind 9.4.2
isc bind 9.4.0
isc bind 9.4
isc bind 9.3.5
isc bind 9.3.4
isc bind 9.3.1
isc bind 9.3.0
isc bind 9.2.7
isc bind 9.2.4
isc bind 9.2.3
isc bind 9.2.1
isc bind 9.2.0
isc bind 9.1.1
isc bind 9.1.0
isc bind 9.1
isc bind 9.0.0
isc bind 9.7.5
isc bind 9.7.1
isc bind 9.6.1
isc bind 9.4.1
isc bind 9.3.3
isc bind 9.3
isc bind 9.2.6
isc bind 9.9.1
isc bind 9.3.2
isc bind 9.2.8
isc bind 9.2.5
isc bind 9.2.2
isc bind 9.1.2
isc bind 9.2
isc bind 9.1.3
isc bind 9.0.1
isc bind 9.0
isc bind 9.5
isc bind 9.3.6
isc bind 9.2.9

Bind could be made to crash if it received specially crafted network traffic ...

Synopsis Important: bind security update Type/Severity Security Advisory: Important Topic Updated bind packages that fix two security issues are now available forRed Hat Enterprise Linux 5 and 6The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerability ...

Synopsis Important: bind security update Type/Severity Security Advisory: Important Topic Updated bind packages that fix one security issue are now available forRed Hat Enterprise Linux 4 Extended Life Cycle SupportThe Red Hat Security Response Team has rated this update as havingimportant security impact ...

Synopsis Important: bind97 security update Type/Severity Security Advisory: Important Topic Updated bind97 packages that fix two security issues are now available forRed Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerability S ...

It was discovered that BIND, a DNS server, can crash while processing resource records containing no data bytes Both authoritative servers and resolvers are affected For the stable distribution (squeeze), this problem has been fixed in version 1:973dfsg-1~squeeze5 We recommend that you upgrade your bind9 packages ...

A flaw was found in the way BIND handled zero length resource data records A malicious owner of a DNS domain could use this flaw to create specially-crafted DNS resource records that would cause a recursive resolver or secondary server to crash or, possibly, disclose portions of its memory (CVE-2012-1667) A flaw was found in the way BIND handled ...

For each available CPE the script prints out known vulns (links to the correspondent info) and correspondent CVSS scores.

nmap -sV --script vulners [--script-args mincvss=<arg_val>] <target>

53/tcp   open     domain             ISC BIND DNS
| vulners:
|   ISC BIND DNS:
|     CVE-2012-1667    8.5    https://vulners.com/cve/CVE-2012-1667
|     CVE-2002-0651    7.5    https://vulners.com/cve/CVE-2002-0651
|     CVE-2002-0029    7.5    https://vulners.com/cve/CVE-2002-0029
|     CVE-2015-5986    7.1    https://vulners.com/cve/CVE-2015-5986
|     CVE-2010-3615    5.0    https://vulners.com/cve/CVE-2010-3615
|     CVE-2006-0987    5.0    https://vulners.com/cve/CVE-2006-0987
|_    CVE-2014-3214    5.0    https://vulners.com/cve/CVE-2014-3214

CWE-189 http://www.isc.org/software/bind/advisories/cve-2012-1667 https://kb.isc.org/article/AA-00698 http://marc.info/?l=bugtraq&m=134132772016230&w=2 http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html http://support.apple.com/kb/HT5501 http://rhn.redhat.com/errata/RHSA-2012-1110.html http://secunia.com/advisories/51096 http://www.mandriva.com/security/advisories?name=MDVSA-2012:089 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.536004 http://www.securityfocus.com/bid/53772 https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488 http://www.kb.cert.org/vuls/id/381699 http://www.debian.org/security/2012/dsa-2486 http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00005.html http://rhn.redhat.com/errata/RHSA-2012-0717.html https://usn.ubuntu.com/1462-1/https://nvd.nist.gov https://www.kb.cert.org/vuls/id/381699

CVE-2012-1667

Vulnerability Summary

Vendor Advisories

Nmap Scripts

References

Vulmon Search

About

Products

Connect