4.3
CVSSv2

CVE-2007-0494

Published: 25/01/2007 Updated: 11/10/2017
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Vulnerability Summary

ISC BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote malicious users to cause a denial of service (exit) via a type * (ANY) DNS query response that contains multiple RRsets, which triggers an assertion error, aka the "DNSSEC Validation" vulnerability.

Vulnerable Product Search on Vulmon Subscribe to Product

isc bind 9.4.0

isc bind 9.3.1

isc bind 9.3.0

isc bind 9.2.4

isc bind 9.2.3

isc bind 9.2.1

isc bind 9.3.2

isc bind 9.2.5

isc bind 9.2.2

isc bind 9.2.0

isc bind 9.1.3

isc bind 9.1.2

isc bind 9.1.1

isc bind 9.0.0

isc bind 9.5.0

isc bind 9.2.6

isc bind 9.0.1

isc bind 9.3

isc bind 9.2

isc bind 9.0

isc bind 9.1.0

isc bind 9.1

Vendor Advisories

Debian Bug report logs - #408432 BIND remote exploit Package: bind9; Maintainer for bind9 is Debian DNS Team <team+dns@trackerdebianorg>; Source for bind9 is src:bind9 (PTS, buildd, popcon) Reported by: Christian Hammers <ch@debianorg> Date: Thu, 25 Jan 2007 20:18:02 UTC Severity: important Tags: security Found ...
A flaw was discovered in Bind’s DNSSEC validation code Remote attackers could send a specially crafted DNS query which would cause the Bind server to crash, resulting in a denial of service Only servers configured to use DNSSEC extensions were vulnerable ...

References

CWE-19http://www.isc.org/index.pl?/sw/bind/view/?release=9.2.8http://www.isc.org/index.pl?/sw/bind/view/?release=9.3.4http://secunia.com/advisories/23904http://www.isc.org/index.pl?/sw/bind/bind-security.phphttps://issues.rpath.com/browse/RPL-989http://www.debian.org/security/2007/dsa-1254http://fedoranews.org/cms/node/2507http://fedoranews.org/cms/node/2537http://security.freebsd.org/advisories/FreeBSD-SA-07:02.bind.aschttp://security.gentoo.org/glsa/glsa-200702-06.xmlhttp://www.openpkg.com/security/advisories/OpenPKG-SA-2007.007.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0044.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0057.htmlhttp://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.494157http://lists.suse.com/archive/suse-security-announce/2007-Jan/0016.htmlhttp://www.trustix.org/errata/2007/0005http://www.ubuntu.com/usn/usn-418-1http://www.securityfocus.com/bid/22231http://securitytracker.com/id?1017573http://secunia.com/advisories/23972http://secunia.com/advisories/23924http://secunia.com/advisories/23944http://secunia.com/advisories/23943http://secunia.com/advisories/23974http://secunia.com/advisories/23977http://secunia.com/advisories/24054http://secunia.com/advisories/24014http://secunia.com/advisories/24083http://secunia.com/advisories/24048http://secunia.com/advisories/24129http://secunia.com/advisories/24203http://support.avaya.com/elmodocs2/security/ASA-2007-125.htmhttp://secunia.com/advisories/24648http://secunia.com/advisories/24950http://secunia.com/advisories/24930http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.htmlhttp://docs.info.apple.com/article.html?artnum=305530http://www-1.ibm.com/support/docview.wss?uid=isg1IY95618http://www-1.ibm.com/support/docview.wss?uid=isg1IY95619http://www-1.ibm.com/support/docview.wss?uid=isg1IY96144http://www-1.ibm.com/support/docview.wss?uid=isg1IY96324http://lists.apple.com/archives/security-announce/2007/May/msg00004.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2007:030http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-003.txt.ascftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.aschttp://sunsolve.sun.com/search/document.do?assetkey=1-26-102969-1http://secunia.com/advisories/25402http://secunia.com/advisories/25649http://secunia.com/advisories/25715http://secunia.com/advisories/24284http://secunia.com/advisories/25482http://secunia.com/advisories/26909http://secunia.com/advisories/27706http://www.vupen.com/english/advisories/2007/2315http://www.vupen.com/english/advisories/2007/2163http://www.vupen.com/english/advisories/2007/1939http://www.vupen.com/english/advisories/2007/3229http://www.vupen.com/english/advisories/2007/1401http://www.vupen.com/english/advisories/2007/2245https://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01070495http://www.vupen.com/english/advisories/2007/2002http://marc.info/?l=bind-announce&m=116968519300764&w=2https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488https://exchange.xforce.ibmcloud.com/vulnerabilities/31838https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11523https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=408432https://usn.ubuntu.com/418-1/https://nvd.nist.gov