Published: 29/07/2013 Updated: 22/04/2019

CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10

VMScore: 695

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x prior to 9.8.5-P2, 9.8.6b1, 9.9.x prior to 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 prior to 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote malicious users to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.

Vulnerable Product	Search on Vulmon	Subscribe to Product
isc bind 9.7.0
isc bind 9.7.1
isc bind 9.7.2
isc bind 9.7.3
isc bind 9.7.5
isc bind 9.7.6
isc bind 9.7.4
isc bind 9.7.7
suse suse linux enterprise software development kit 11.0
novell suse linux 11
isc dnsco bind 9.9.3
isc dnsco bind 9.9.4
opensuse opensuse 11.4
isc bind 9.9.3
isc bind 9.9.0
isc bind 9.9.1
isc bind 9.9.2
freebsd freebsd 9.1
freebsd freebsd 8.3
freebsd freebsd 8.4
freebsd freebsd 9.2
freebsd freebsd 8.0
freebsd freebsd 8.1
freebsd freebsd 8.2
freebsd freebsd 9.0
mandriva enterprise server 5.0
mandriva business server 1.0
redhat enterprise linux 5
redhat enterprise linux 6.0
isc bind 9.8.5
isc bind 9.8.0
isc bind 9.8.3
isc bind 9.8.2
isc bind 9.8.1
isc bind 9.8.6
isc bind 9.8.4
fedoraproject fedora 18
fedoraproject fedora 19
hp hp-ux b.11.31
slackware slackware linux 13.1
slackware slackware linux 13.0
slackware slackware linux 13.37
slackware slackware linux 12.2
slackware slackware linux 12.1

Debian Bug report logs - #717936 bind9: CVE-2013-4854: A specially crafted query can cause BIND to terminate abnormally Package: bind9; Maintainer for bind9 is Debian DNS Team <team+dns@trackerdebianorg>; Source for bind9 is src:bind9 (PTS, buildd, popcon) Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: ...

Bind could be made to crash if it received specially crafted network traffic ...

Maxim Shudrak and the HP Zero Day Initiative reported a denial of service vulnerability in BIND, a DNS server A specially crafted query that includes malformed rdata can cause named daemon to terminate with an assertion failure while rejecting the malformed query For the oldstable distribution (squeeze), this problem has been fixed in version 1:9 ...

A denial of service flaw was found in BIND A remote attacker could use this flaw to send a specially-crafted DNS query to named that, when processed, would cause named to crash when rejecting the malformed query (CVE-2013-4854) ...

NVD-CWE-noinfo https://kb.isc.org/article/AA-01016 https://kb.isc.org/article/AA-01015 http://secunia.com/advisories/54432 http://secunia.com/advisories/54211 http://secunia.com/advisories/54134 http://secunia.com/advisories/54207 http://www.securitytracker.com/id/1028838 http://secunia.com/advisories/54185 http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113251.html http://rhn.redhat.com/errata/RHSA-2013-1115.html http://www.freebsd.org/security/advisories/FreeBSD-SA-13:07.bind.asc http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00004.html http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113108.html http://www.mandriva.com/security/advisories?name=MDVSA-2013:202 http://www.securityfocus.com/bid/61479 http://secunia.com/advisories/54323 http://rhn.redhat.com/errata/RHSA-2013-1114.html http://archives.neohapsis.com/archives/bugtraq/2013-08/0030.html http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00018.html https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03922396 https://kc.mcafee.com/corporate/index?page=content&id=SB10052 http://www.zerodayinitiative.com/advisories/ZDI-13-210/http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html https://support.apple.com/kb/HT6536 http://linux.oracle.com/errata/ELSA-2014-1244 https://exchange.xforce.ibmcloud.com/vulnerabilities/86004 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19561 http://www.ubuntu.com/usn/USN-1910-1 http://www.debian.org/security/2013/dsa-2728 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=717936 https://usn.ubuntu.com/1910-1/https://nvd.nist.gov

CVE-2013-4854

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect