5.4
CVSSv2

CVE-2015-1349

Published: 19/02/2015 Updated: 30/10/2018
CVSS v2 Base Score: 5.4 | Impact Score: 6.9 | Exploitability Score: 4.9
VMScore: 485
Vector: AV:N/AC:H/Au:N/C:N/I:N/A:C

Vulnerability Summary

named in ISC BIND 9.7.0 up to and including 9.9.6 prior to 9.9.6-P2 and 9.10.x prior to 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote malicious users to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.

Vulnerable Product Search on Vulmon Subscribe to Product

isc bind 9.7.0

isc bind 9.7.2

isc bind 9.7.4

isc bind 9.7.6

isc bind 9.8.0

isc bind 9.8.2

isc bind 9.8.5

isc bind 9.8.6

isc bind 9.9.0

isc bind 9.9.3

isc bind 9.9.6

isc bind 9.9.7

isc bind 9.7.3

isc bind 9.7.5

isc bind 9.8.1

isc bind 9.8.4

isc bind 9.9.5

isc bind 9.7.1

isc bind 9.8.3

isc bind 9.9.1

isc bind 9.9.2

isc bind 9.9.4

isc bind 9.10.2

isc bind 9.7.7

isc bind 9.10.0

isc bind 9.10.1

Vendor Advisories

Debian Bug report logs - #778733 bind9: CVE-2015-1349 named crash Package: src:bind9; Maintainer for src:bind9 is Debian DNS Team <team+dns@trackerdebianorg>; Reported by: Michael Gilbert <mgilbert@debianorg> Date: Thu, 19 Feb 2015 03:48:01 UTC Severity: serious Tags: fixed-upstream, security, upstream Found in v ...
Bind could be made to crash if it received specially crafted network traffic ...
Jan-Piet Mens discovered that the BIND DNS server would crash when processing an invalid DNSSEC key rollover, either due to an error on the zone operator's part, or due to interference with network traffic by an attacker This issue affects configurations with the directives "dnssec-validation auto;" (as enabled in the Debian default configuration) ...
A flaw was found in the way BIND handled trust anchor management A remote attacker could use this flaw to cause the BIND daemon (named) to crash under certain conditions ...