Lucene search
HistoryJan 22, 2010 - 10:00 p.m.
CVE-2010-0382
isc bind
cve-2010-0382
remote attack
bug 20819
out-of-bailiwick data
secure response
vulnerability
7.6 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
7.6 High
AI Score
Confidence
High
0.04 Low
EPSS
Percentile
92.1%
ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.
Affected configurations
Node
iscbindMatch9.0
ORiscbindMatch9.0.0rc1
ORiscbindMatch9.0.0rc2
ORiscbindMatch9.0.0rc3
ORiscbindMatch9.0.0rc4
ORiscbindMatch9.0.0rc5
ORiscbindMatch9.0.0rc6
ORiscbindMatch9.0.1
ORiscbindMatch9.0.1rc1
ORiscbindMatch9.0.1rc2
ORiscbindMatch9.1
ORiscbindMatch9.1.0rc1
ORiscbindMatch9.1.1
ORiscbindMatch9.1.1rc1
ORiscbindMatch9.1.1rc2
ORiscbindMatch9.1.1rc3
ORiscbindMatch9.1.1rc4
ORiscbindMatch9.1.1rc5
ORiscbindMatch9.1.1rc6
ORiscbindMatch9.1.1rc7
ORiscbindMatch9.1.2
ORiscbindMatch9.1.2rc1
ORiscbindMatch9.1.3
ORiscbindMatch9.1.3rc1
ORiscbindMatch9.1.3rc2
ORiscbindMatch9.1.3rc3
ORiscbindMatch9.2
ORiscbindMatch9.2.0
ORiscbindMatch9.2.0a1
ORiscbindMatch9.2.0a2
ORiscbindMatch9.2.0a3
ORiscbindMatch9.2.0b1
ORiscbindMatch9.2.0b2
ORiscbindMatch9.2.0rc1
ORiscbindMatch9.2.0rc10
ORiscbindMatch9.2.0rc2
ORiscbindMatch9.2.0rc3
ORiscbindMatch9.2.0rc4
ORiscbindMatch9.2.0rc5
ORiscbindMatch9.2.0rc6
ORiscbindMatch9.2.0rc7
ORiscbindMatch9.2.0rc8
ORiscbindMatch9.2.0rc9
ORiscbindMatch9.2.1
ORiscbindMatch9.2.1rc1
ORiscbindMatch9.2.1rc2
ORiscbindMatch9.2.2
ORiscbindMatch9.2.2p2
ORiscbindMatch9.2.2p3
ORiscbindMatch9.2.2rc1
ORiscbindMatch9.2.3
ORiscbindMatch9.2.3rc1
ORiscbindMatch9.2.3rc2
ORiscbindMatch9.2.3rc3
ORiscbindMatch9.2.3rc4
ORiscbindMatch9.2.4
ORiscbindMatch9.2.4rc2
ORiscbindMatch9.2.4rc3
ORiscbindMatch9.2.4rc4
ORiscbindMatch9.2.4rc5
ORiscbindMatch9.2.4rc6
ORiscbindMatch9.2.4rc7
ORiscbindMatch9.2.4rc8
ORiscbindMatch9.2.5
ORiscbindMatch9.2.5b2
ORiscbindMatch9.2.5rc1
ORiscbindMatch9.2.6
ORiscbindMatch9.2.6rc1
ORiscbindMatch9.2.7
ORiscbindMatch9.2.7rc1
ORiscbindMatch9.2.7rc2
ORiscbindMatch9.2.7rc3
ORiscbindMatch9.2.8
ORiscbindMatch9.2.9
ORiscbindMatch9.2.9rc1
ORiscbindMatch9.3
ORiscbindMatch9.3.0
ORiscbindMatch9.3.0b2
ORiscbindMatch9.3.0b3
ORiscbindMatch9.3.0b4
ORiscbindMatch9.3.0rc1
ORiscbindMatch9.3.0rc2
ORiscbindMatch9.3.0rc3
ORiscbindMatch9.3.0rc4
ORiscbindMatch9.3.1
ORiscbindMatch9.3.1b2
ORiscbindMatch9.3.1rc1
ORiscbindMatch9.3.2
ORiscbindMatch9.3.2rc1
ORiscbindMatch9.3.3
ORiscbindMatch9.3.3rc1
ORiscbindMatch9.3.3rc2
ORiscbindMatch9.3.3rc3
ORiscbindMatch9.3.4
ORiscbindMatch9.3.5
ORiscbindMatch9.3.5rc1
ORiscbindMatch9.3.5rc2
ORiscbindMatch9.3.6
ORiscbindMatch9.3.6rc1
ORiscbindMatch9.4
ORiscbindMatch9.4.0
ORiscbindMatch9.4.0a1
ORiscbindMatch9.4.0a2
ORiscbindMatch9.4.0a3
ORiscbindMatch9.4.0a4
ORiscbindMatch9.4.0a5
ORiscbindMatch9.4.0a6
ORiscbindMatch9.4.0b1
ORiscbindMatch9.4.0b2
ORiscbindMatch9.4.0b3
ORiscbindMatch9.4.0b4
ORiscbindMatch9.4.0rc1
ORiscbindMatch9.4.0rc2
ORiscbindMatch9.4.1
ORiscbindMatch9.4.2
ORiscbindMatch9.4.2rc1
ORiscbindMatch9.4.2rc2
ORiscbindMatch9.4.3
ORiscbindMatch9.4.3b1
ORiscbindMatch9.4.3b2
ORiscbindMatch9.4.3b3
ORiscbindMatch9.4.3p1
ORiscbindMatch9.4.3p2
ORiscbindMatch9.4.3p3
ORiscbindMatch9.4.3p4
ORiscbindMatch9.4.3p5
ORiscbindMatch9.4.3rc1
ORiscbindMatch9.6.0
ORiscbindMatch9.6.0a1
ORiscbindMatch9.6.0b1
ORiscbindMatch9.6.0p1
ORiscbindMatch9.6.0rc1
ORiscbindMatch9.6.0rc2
ORiscbindMatch9.6.1
ORiscbindMatch9.6.1b1
ORiscbindMatch9.6.1p1
ORiscbindMatch9.6.1p2
ORiscbindMatch9.6.1rc1
ORiscbindMatch9.7.0b1
ORiscbindMatch9.10.0
ORiscbindMatch9.10.0a1
ORiscbindMatch9.10.0a2
ORiscbindMatch9.10.0b1
ORiscbindMatch9.10.0b2
ORiscbindMatch9.10.0p1
ORiscbindMatch9.10.0p2
ORiscbindMatch9.10.0rc1
ORiscbindMatch9.10.0rc2
ORiscbindMatch9.10.1
ORiscbindMatch9.10.1b1
ORiscbindMatch9.10.1b2
ORiscbindMatch9.10.1p1
ORiscbindMatch9.10.1p2
ORiscbindMatch9.10.1rc1
ORiscbindMatch9.10.1rc2
ORiscbindMatch9.10.2b1
ORiscbindMatch9.10.2p1
ORiscbindMatch9.10.2p2
ORiscbindMatch9.10.2p3
ORiscbindMatch9.10.2p4
ORiscbindMatch9.10.2rc1
ORiscbindMatch9.10.2rc2
ORiscbindMatch9.10.3
ORiscbindMatch9.10.3b1
ORiscbindMatch9.10.3p1
ORiscbindMatch9.10.3p2
ORiscbindMatch9.10.3p3
ORiscbindMatch9.10.3rc1
References
secunia.com/advisories/40086
wiki.rpath.com/wiki/Advisories:rPSA-2010-0018
www.debian.org/security/2010/dsa-2054
www.vupen.com/english/advisories/2010/0622
www.vupen.com/english/advisories/2010/1352
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11753
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6665
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7086
www.isc.org/advisories/CVE-2009-4022v6
Related
nvd
nvd
prion
prion
Code injection
2010-01-22 22:00:00
Design/Logic Flaw
2009-11-25 16:30:00
Design/Logic Flaw
2010-01-22 22:00:00
nessus
nessus
ISC BIND 9 DNSSEC Cache Poisoning
2009-12-02 00:00:00
F5 Networks BIG-IP : BIND vulnerability (SOL15787)
2014-11-04 00:00:00
Oracle Linux 5 : bind (ELSA-2010-0062)
2013-07-12 00:00:00
cvelist
cvelist
f5
f5
K15787 : BIND vulnerability CVE-2010-0382
2014-11-03 00:00:00
SOL15787 - BIND vulnerability CVE-2010-0382
2014-11-03 00:00:00
K10898 : DNSSEC BIND vulnerability - CVE-2009-4022
2013-07-03 00:00:00
ubuntucve
ubuntucve
debiancve
debiancve
securityvulns
securityvulns
bind DNS server cache poisoning
2010-03-17 00:00:00
rPSA-2010-0018-1 bind bind-utils caching-nameserver
2010-03-17 00:00:00
[ MDVSA-2009:304 ] bind
2009-12-01 00:00:00
openvas
openvas
HP-UX Update for BIND HPSBUX02546
2010-10-01 00:00:00
HP-UX Update for BIND HPSBUX02546
2010-10-01 00:00:00
Gentoo Security Advisory GLSA 201006-11 (BIND)
2011-03-09 00:00:00
redhat
redhat
(RHSA-2010:0062) Moderate: bind security update
2010-01-20 00:00:00
(RHSA-2009:1620) Moderate: bind security update
2009-11-30 00:00:00
centos
centos
bind, caching security update
2010-01-20 17:59:57
bind, caching security update
2009-12-17 12:39:21
gentoo
gentoo
BIND: Multiple vulnerabilities
2010-06-01 00:00:00
oraclelinux
oraclelinux
bind security update
2010-01-20 00:00:00
bind security update
2009-11-30 00:00:00
debian
debian
[SECURITY] [DSA 2054-2] New bind9 packages fix cache poisoning
2010-06-15 20:05:57
[SECURITY] [DSA 2054-1] New bind9 packages fix cache poisoning
2010-06-04 19:22:30
[SECURITY] [DSA 1961-1] New bind9 packages fix cache poisoning
2009-12-23 07:07:33
osv
osv
bind9 - cache poisoning
2010-06-04 00:00:00
bind9 - cache poisoning
2009-12-23 00:00:00
cert
cert
BIND DNS Nameserver, DNSSEC validation Vulnerability
2009-12-01 00:00:00
checkpoint_security
checkpoint_security
seebug
seebug
ISC BIND 9 DNSSEC查询响应远程缓存中毒漏洞
2009-11-27 00:00:00
ubuntu
ubuntu
Bind vulnerability
2009-12-07 00:00:00
Bind vulnerabilities
2010-01-20 00:00:00
veracode
veracode
Cache Poisoning Attack
2020-04-10 00:41:27
Cache Poisoning Attack
2020-04-10 00:41:38
fedora
fedora
[SECURITY] Fedora 12 Update: bind-9.6.1-13.P2.fc12
2009-11-27 21:43:51
[SECURITY] Fedora 12 Update: bind-9.6.1-15.P3.fc12
2010-01-21 00:14:47
[SECURITY] Fedora 11 Update: bind-9.6.1-7.P2.fc11
2009-11-27 21:40:17
slackware
slackware
bind
2009-12-02 17:30:47
[slackware-security] bind
2010-06-25 18:32:41
freebsd_advisory
freebsd_advisory
FreeBSD-SA-10:01.bind
2010-01-06 00:00:00
suse
suse
DNSSEC cache poisoning in bind
2009-12-02 11:21:35
remote code execution in acroread
2010-01-26 16:40:23
cve
cve
CVE-2009-4022
2009-11-25 16:30:00
CVE-2010-0290
2010-01-22 22:00:00
altlinux
altlinux
Security fix for the ALT Linux 9 package bind version 9.3.6-alt7
2011-12-16 00:00:00
Security fix for the ALT Linux 8 package bind version 9.3.6-alt7
2011-12-16 00:00:00
Security fix for the ALT Linux 6 package bind version 9.3.6-alt7
2011-12-16 00:00:00
vmware
vmware
ESXi utilities and ESX Service Console third party updates
2010-05-27 00:00:00
ESXi utilities and ESX Service Console third party updates
2010-05-27 00:00:00
ESX Service Console and vMA third party updates
2010-03-03 00:00:00
7.6 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
7.6 High
AI Score
Confidence
High
0.04 Low
EPSS
Percentile
92.1%
Related for CVE-2010-0382