7.8
CVSSv2

CVE-2012-4244

Published: 14/09/2012 Updated: 09/12/2022
CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10
VMScore: 695
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Vulnerability Summary

ISC BIND 9.x prior to 9.7.6-P3, 9.8.x prior to 9.8.3-P3, 9.9.x prior to 9.9.1-P3, and 9.4-ESV and 9.6-ESV prior to 9.6-ESV-R7-P3 allows remote malicious users to cause a denial of service (assertion failure and named daemon exit) via a query for a long resource record.

Vulnerable Product Search on Vulmon Subscribe to Product

isc bind 9.6.2

isc bind 9.6.1

isc bind 9.2.0

isc bind 9.1.1

isc bind 9.3.1

isc bind 9.8.1

isc bind 9.8.3

isc bind 9.5.0

isc bind 9.5.2

isc bind 9.5.1

isc bind 9.7.0

isc bind 9.2.3

isc bind 9.9.0

isc bind 9.7.5

isc bind 9.4.3

isc bind 9.4

isc bind 9.1.3

isc bind 9.6

isc bind 9.7.1

isc bind 9.8.2

isc bind 9.7.4

isc bind 9.4.0

isc bind 9.3.5

isc bind 9.3.2

isc bind 9.7.2

isc bind 9.3.0

isc bind 9.2.1

isc bind 9.2

isc bind 9.2.8

isc bind 9.0.0

isc bind 9.5

isc bind 9.2.4

isc bind 9.8.0

isc bind 9.3

isc bind 9.3.4

isc bind 9.2.7

isc bind 9.6.3

isc bind 9.3.6

isc bind 9.2.5

isc bind 9.1.0

isc bind 9.6.0

isc bind 9.4.1

isc bind 9.3.3

isc bind 9.2.2

isc bind 9.4.2

isc bind 9.2.9

isc bind 9.9.1

isc bind 9.7.6

isc bind 9.7.3

isc bind 9.1

isc bind 9.1.2

isc bind 9.2.6

isc bind 9.0.1

isc bind 9.0

isc bind 9.5.3

Vendor Advisories

Debian Bug report logs - #693015 bind9: CVE-2012-4244 - A specially crafted Resource Record could cause named to terminate Package: bind9; Maintainer for bind9 is Debian DNS Team <team+dns@trackerdebianorg>; Source for bind9 is src:bind9 (PTS, buildd, popcon) Reported by: Matthew Grant <matthewgrant5@gmailcom> Dat ...
Bind could be made to crash or if it received specially crafted network traffic ...
Synopsis Important: bind security update Type/Severity Security Advisory: Important Topic Updated bind packages that fix two security issues are now available forRed Hat Enterprise Linux 4 Extended Life Cycle SupportThe Red Hat Security Response Team has rated this update as havingimportant security impact ...
Synopsis Important: bind security and bug fix update Type/Severity Security Advisory: Important Topic Updated bind packages that fix one security issue and one bug are nowavailable for Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as havingimportant security impact A C ...
Synopsis Important: bind97 security update Type/Severity Security Advisory: Important Topic Updated bind97 packages that fix one security issue are now available forRed Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as havingimportant security impact A Common Vulnerability ...
Synopsis Important: bind security update Type/Severity Security Advisory: Important Topic Updated bind packages that fix one security issue are now available forRed Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as havingimportant security impact A Common Vulnerability Scor ...
It was discovered that BIND, a DNS server, does not handle DNS records properly which approach size limits inherent to the DNS protocol An attacker could use crafted DNS records to crash the BIND server process, leading to a denial of service For the stable distribution (squeeze), this problem has been fixed in version 1:973dfsg-1~squeeze7 We ...
A flaw was found in the way BIND handled resource records with a large RDATA value A malicious owner of a DNS domain could use this flaw to create specially-crafted DNS resource records, that would cause a recursive resolver or secondary server to exit unexpectedly with an assertion failure (CVE-2012-4244) ...

Github Repositories

patched dig-9.9.3 that supports edns-subnet

Bind 910 版本官方已经merge了EDNS CLIENT SUBNET功能, 此仓库请勿使用!! Bind-993 --Reverier-patched 本仓库包含已经编译好的打过补丁的bind-993 Usage 在本仓库目录下, 执行 /bin/dig/dig @<DNS Server> <Target Server Domain> +client=<Querier IP address> 即可

patched dig-9.9.3 that supports edns-subnet

Bind 910 版本官方已经merge了EDNS CLIENT SUBNET功能, 此仓库请勿使用!! Bind-993 --Reverier-patched 本仓库包含已经编译好的打过补丁的bind-993 Usage 在本仓库目录下, 执行 /bin/dig/dig @<DNS Server> <Target Server Domain> +client=<Querier IP address> 即可

References

NVD-CWE-noinfohttps://kb.isc.org/article/AA-00778http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-10/msg00007.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1365.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1268.htmlhttp://www.ubuntu.com/usn/USN-1566-1http://rhn.redhat.com/errata/RHSA-2012-1267.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-09/msg00022.htmlhttp://www.debian.org/security/2012/dsa-2547http://rhn.redhat.com/errata/RHSA-2012-1266.htmlhttp://secunia.com/advisories/50673http://secunia.com/advisories/50582http://secunia.com/advisories/50579http://secunia.com/advisories/50560http://secunia.com/advisories/50645http://lists.fedoraproject.org/pipermail/package-announce/2012-September/087703.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-September/088381.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-September/087697.htmlhttp://secunia.com/advisories/51096http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.htmlhttp://support.apple.com/kb/HT5880http://www.mandriva.com/security/advisories?name=MDVSA-2012:152http://marc.info/?l=bugtraq&m=141879471518471&w=2http://www.securityfocus.com/bid/55522https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488https://security.netapp.com/advisory/ntap-20221209-0008/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693015https://usn.ubuntu.com/1566-1/https://nvd.nist.gov