7.8
CVSSv2

CVE-2012-5166

Published: 10/10/2012 Updated: 19/09/2017
CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10
VMScore: 696
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Vulnerability Summary

ISC BIND 9.x prior to 9.7.6-P4, 9.8.x prior to 9.8.3-P4, 9.9.x prior to 9.9.1-P4, and 9.4-ESV and 9.6-ESV prior to 9.6-ESV-R7-P4 allows remote malicious users to cause a denial of service (named daemon hang) via unspecified combinations of resource records.

Vulnerable Product Search on Vulmon Subscribe to Product

isc bind 9.6

isc bind 9.4

isc bind 9.9.0

isc bind 9.8.3

isc bind 9.8.1

isc bind 9.8.0

isc bind 9.7.5

isc bind 9.7.3

isc bind 9.7.1

isc bind 9.7.0

isc bind 9.6.3

isc bind 9.6.1

isc bind 9.6.0

isc bind 9.9.1

isc bind 9.8.2

isc bind 9.7.4

isc bind 9.7.2

isc bind 9.6.2

isc bind 9.5.3

isc bind 9.5.2

isc bind 9.5.0

isc bind 9.4.3

isc bind 9.4.2

isc bind 9.4.0

isc bind 9.3.4

isc bind 9.3.3

isc bind 9.3.1

isc bind 9.3.0

isc bind 9.3

isc bind 9.2.6

isc bind 9.7.6

isc bind 9.2.4

isc bind 9.2.3

isc bind 9.2.0

isc bind 9.1.3

isc bind 9.1.1

isc bind 9.0.1

isc bind 9.0

isc bind 9.5.1

isc bind 9.5

isc bind 9.3.5

isc bind 9.2.7

isc bind 9.2.1

isc bind 9.1

isc bind 9.0.0

isc bind 9.3.6

isc bind 9.2.9

isc bind 9.2.5

isc bind 9.2.2

isc bind 9.1.2

isc bind 9.4.1

isc bind 9.3.2

isc bind 9.2.8

isc bind 9.1.0

Vendor Advisories

Debian Bug report logs - #690118 CVE-2012-5166: Specially crafted DNS data can cause a lockup in named Package: bind9; Maintainer for bind9 is Debian DNS Team <team+dns@trackerdebianorg>; Source for bind9 is src:bind9 (PTS, buildd, popcon) Reported by: Henri Salo <henri@nervfi> Date: Wed, 10 Oct 2012 07:33:01 UTC ...
Bind could be made to crash if it received specially crafted network traffic ...
Synopsis Important: bind security update Type/Severity Security Advisory: Important Topic Updated bind packages that fix one security issue are now available forRed Hat Enterprise Linux 5 and 6The Red Hat Security Response Team has rated this update as havingimportant security impact A Common Vulnerabilit ...
Synopsis Important: bind97 security update Type/Severity Security Advisory: Important Topic Updated bind97 packages that fix one security issue are now available forRed Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as havingimportant security impact A Common Vulnerability ...
Synopsis Important: bind security update Type/Severity Security Advisory: Important Topic Updated bind packages that fix two security issues are now available forRed Hat Enterprise Linux 4 Extended Life Cycle SupportThe Red Hat Security Response Team has rated this update as havingimportant security impact ...
It was discovered that BIND, a DNS server, hangs while constructing the additional section of a DNS reply, when certain combinations of resource records are present This vulnerability affects both recursive and authoritative servers For the stable distribution (squeeze), this problem has been fixed in version 1:973dfsg-1~squeeze8 We recommend ...
A flaw was found in the way BIND handled certain combinations of resource records A remote attacker could use this flaw to cause a recursive resolver, or an authoritative server in certain configurations, to lockup (CVE-2012-5166) ...

References

CWE-189https://kb.isc.org/article/AA-00801http://rhn.redhat.com/errata/RHSA-2012-1364.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1365.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-October/090491.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-October/090586.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-10/msg00013.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-10/msg00011.htmlhttp://www.debian.org/security/2012/dsa-2560http://www.securityfocus.com/bid/55852http://www.isc.org/software/bind/advisories/cve-2012-5166http://rhn.redhat.com/errata/RHSA-2012-1363.htmlhttp://secunia.com/advisories/51054http://secunia.com/advisories/50903http://secunia.com/advisories/50909http://secunia.com/advisories/50956http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090346.htmlhttp://secunia.com/advisories/51096http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdfhttp://secunia.com/advisories/51106http://www.ibm.com/support/docview.wss?uid=isg1IV30366http://www.ibm.com/support/docview.wss?uid=isg1IV30368https://blogs.oracle.com/sunsecurity/entry/cve_2012_5166_denial_ofhttp://www.ibm.com/support/docview.wss?uid=isg1IV30364http://www.ibm.com/support/docview.wss?uid=isg1IV30367http://secunia.com/advisories/51078http://www.ibm.com/support/docview.wss?uid=isg1IV30365http://osvdb.org/86118http://www.ibm.com/support/docview.wss?uid=isg1IV30247http://secunia.com/advisories/51178http://www.mandriva.com/security/advisories?name=MDVSA-2012:162http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.htmlhttp://support.apple.com/kb/HT5880http://www.ibm.com/support/docview.wss?uid=isg1IV30185http://aix.software.ibm.com/aix/efixes/security/bind9_advisory5.aschttp://www.slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.536004http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19706https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690118https://usn.ubuntu.com/1601-1/https://nvd.nist.gov