7.8
CVSSv2

CVE-2014-8500

Published: 11/12/2014 Updated: 03/01/2017
CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10
VMScore: 695
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Vulnerability Summary

ISC BIND 9.0.x up to and including 9.8.x, 9.9.0 up to and including 9.9.6, and 9.10.0 up to and including 9.10.1 does not limit delegation chaining, which allows remote malicious users to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

isc bind 9.1

isc bind 9.1.1

isc bind 9.2.3

isc bind 9.2.4

isc bind 9.3.0

isc bind 9.3.1

isc bind 9.4.1

isc bind 9.4.2

isc bind 9.6.0

isc bind 9.6.1

isc bind 9.7.4

isc bind 9.7.5

isc bind 9.8.5

isc bind 9.8.6

isc bind 9.9.6

isc bind 9.10.0

isc bind 9.0

isc bind 9.0.1

isc bind 9.2.1

isc bind 9.2.2

isc bind 9.2.9

isc bind 9.3

isc bind 9.4

isc bind 9.4.0

isc bind 9.5.2

isc bind 9.5.3

isc bind 9.7.2

isc bind 9.7.3

isc bind 9.8.3

isc bind 9.8.4

isc bind 9.9.4

isc bind 9.9.5

isc bind 9.2

isc bind 9.2.0

isc bind 9.2.7

isc bind 9.2.8

isc bind 9.3.5

isc bind 9.3.6

isc bind 9.5.0

isc bind 9.5.1

isc bind 9.7.0

isc bind 9.7.1

isc bind 9.8.1

isc bind 9.8.2

isc bind 9.9.2

isc bind 9.9.3

isc bind 9.1.2

isc bind 9.1.3

isc bind 9.2.5

isc bind 9.2.6

isc bind 9.3.2

isc bind 9.3.3

isc bind 9.3.4

isc bind 9.4.3

isc bind 9.5

isc bind 9.6.2

isc bind 9.6.3

isc bind 9.7.6

isc bind 9.7.7

isc bind 9.8.0

isc bind 9.9.0

isc bind 9.9.1

isc bind 9.10.1

Vendor Advisories

Synopsis Important: bind97 security update Type/Severity Security Advisory: Important Topic Updated bind97 packages that fix one security issue are now available forRed Hat Enterprise Linux 5Red Hat Product Security has rated this update as having Important securityimpact A Common Vulnerability Scoring Sy ...
Synopsis Important: bind security update Type/Severity Security Advisory: Important Topic Updated bind packages that fix one security issue are now available for RedHat Enterprise Linux 5, 6, and 7Red Hat Product Security has rated this update as having Important securityimpact A Common Vulnerability Scor ...
Debian Bug report logs - #772610 bind9: CVE-2014-8500: A Defect in Delegation Handling Can Be Exploited to Crash BIND Package: src:bind9; Maintainer for src:bind9 is Debian DNS Team <team+dns@trackerdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 9 Dec 2014 05:57:01 UTC Severity: grave ...
Bind could be made to crash if it received specially crafted network traffic ...
It was discovered that BIND, a DNS server, is prone to a denial of service vulnerability By making use of maliciously-constructed zones or a rogue server, an attacker can exploit an oversight in the code BIND 9 uses to follow delegations in the Domain Name Service, causing BIND to issue unlimited queries in an attempt to follow the delegation Thi ...
A denial of service flaw was found in the way BIND followed DNS delegations A remote attacker could use a specially crafted zone containing a large number of referrals which, when looked up and processed, would cause named to use excessive amounts of memory or crash (CVE-2014-8500) ...

Github Repositories

Open Release Definition Format describes discrete software releases in terms of their life cycle, notating when bugs and vulnerabilities were introduced or removed.

Open Release Definition Open Release Definition Format describes discrete software releases in terms of their life cycle, notating when bugs and vulnerabilities were introduced or removed What is ORDF? ORDF, in a nutshell, specifies a release hierarchy and its implications It provides this via a JSON schema describing each release, what it supersedes, and what it adds or rem

Open Release Definition Format describes discrete software releases in terms of their life cycle, notating when bugs and vulnerabilities were introduced or removed.

Open Release Definition Open Release Definition Format describes discrete software releases in terms of their life cycle, notating when bugs and vulnerabilities were introduced or removed What is ORDF? ORDF, in a nutshell, specifies a release hierarchy and its implications It provides this via a JSON schema describing each release, what it supersedes, and what it adds or rem

References

CWE-399http://ubuntu.com/usn/usn-2437-1https://kb.isc.org/article/AA-01216/http://securitytracker.com/id?1031311http://www.debian.org/security/2014/dsa-3094http://www.securityfocus.com/bid/71590http://www.kb.cert.org/vuls/id/264212http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.htmlhttp://security.gentoo.org/glsa/glsa-201502-03.xmlhttp://lists.opensuse.org/opensuse-security-announce/2015-01/msg00017.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-01/msg00001.htmlhttp://marc.info/?l=bugtraq&m=142180687100892&w=2http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00013.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00009.htmlhttp://advisories.mageia.org/MGASA-2014-0524.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2015:165https://support.apple.com/HT205219http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.htmlhttp://marc.info/?l=bugtraq&m=144000632319155&w=2http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0078.htmlhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10676http://lists.opensuse.org/opensuse-updates/2015-07/msg00038.htmlhttp://secunia.com/advisories/62122http://secunia.com/advisories/62064http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-002.txt.aschttps://security.netapp.com/advisory/ntap-20190730-0002/https://access.redhat.com/errata/RHSA-2014:1985https://usn.ubuntu.com/2437-1/https://nvd.nist.govhttps://www.kb.cert.org/vuls/id/264212