CVE-2010-3614

bind: key algorithm rollover may mark secure answers as insecure

named in ISC BIND 9.x before 9.6.2-P3, 9.7.x before 9.7.2-P3, 9.4-ESV before 9.4-ESV-R4, and 9.6-ESV before 9.6-ESV-R3 does not properly determine the security status of an NS RRset during a DNSKEY algorithm rollover, which might allow remote attackers to cause a denial of service (DNSSEC validation error) by triggering a rollover.

CVSS 2.0 · 6.4 Medium EPSS 14.5% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux

CVE-2010-3615

bind: allow-query processed incorrectly allowing access to authoritative zones that should be restricted

named in ISC BIND 9.7.2-P2 does not check all intended locations for allow-query ACLs, which might allow remote attackers to make successful requests for private DNS records via the standard DNS query mechanism.

CVSS 2.0 · 5.0 Medium EPSS 9.8% KEV · Not listed

Vendors

Isc

Products

Bind

CVE-2010-3762

Bind: DoS (assertion failure) via a DNS query with bad signatures

ISC BIND before 9.7.2-P2, when DNSSEC validation is enabled, does not properly handle certain bad signatures if multiple trust anchors exist for a single zone, which allows remote attackers to cause a denial of service (daemon crash) via a DNS query.

CVSS 2.0 · 4.3 Medium EPSS 8.1% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux

CVE-2011-0414

bind: named lockup with IXFR or DDNS update and a high query rate

ISC BIND 9.7.1 through 9.7.2-P3, when configured as an authoritative server, allows remote attackers to cause a denial of service (deadlock and daemon hang) by sending a query at the time of (1) an IXFR transfer or (2) a DDNS update.

CVSS 2.0 · 7.1 High EPSS 13.7% KEV · Not listed

Vendors

Isc

Products

Bind

CVE-2011-1907

bind: RRSIG queries can trigger server crash when using Response Policy Zones (RPZ)

ISC BIND 9.8.x before 9.8.0-P1, when Response Policy Zones (RPZ) RRset replacement is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an RRSIG query.

CVSS 2.0 · 5.0 Medium EPSS 5.4% KEV · Not listed

Vendors

Isc

Products

Bind

CVE-2011-1910

bind: Large RRSIG RRsets and Negative Caching can crash named

Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before 9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R4-P1 allows remote DNS servers to cause a denial of service (assertion failure and daemon exit) via a negative response containing large RRSIG RRsets.

CVSS 2.0 · 5.0 Medium EPSS 24.6% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux

CVE-2011-2464

bind: Specially constructed packet will cause named to exit

Unspecified vulnerability in ISC BIND 9 9.6.x before 9.6-ESV-R4-P3, 9.7.x before 9.7.3-P3, and 9.8.x before 9.8.0-P4 allows remote attackers to cause a denial of service (named daemon crash) via a crafted UPDATE request.

CVSS 2.0 · 5.0 Medium EPSS 19.3% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux

CVE-2011-2465

bind: Remote Crash with Certain RPZ Configurations

Unspecified vulnerability in ISC BIND 9 9.8.0, 9.8.0-P1, 9.8.0-P2, and 9.8.1b1, when recursion is enabled and the Response Policy Zone (RPZ) contains DNAME or certain CNAME records, allows remote attackers to cause a denial of service (named daemon crash) via an unspecified query.

CVSS 2.0 · 2.6 Low EPSS 8.9% KEV · Not listed

Vendors

Isc

Products

Bind

CVE-2011-4313

bind: Remote denial of service against recursive servers via logging negative cache entry

query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver.

CVSS 2.0 · 5.0 Medium EPSS 16.2% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux

CVE-2012-1033

bind: deleted domain name resolving flaw

The resolver in ISC BIND 9 through 9.8.1-P1 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.

CVSS 2.0 · 5.0 Medium EPSS 13.1% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux

CVE-2012-1667

bind: handling of zero length rdata can cause named to terminate unexpectedly

ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.

CVSS 2.0 · 8.5 High EPSS 13.3% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux Rhel Els

CVE-2012-3817

bind: heavy DNSSEC validation load can cause assertion failure

ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) by sending many queries.

CVSS 2.0 · 7.8 High EPSS 23.7% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux

CVE-2012-3868

bind: high TCP query load can trigger memory leak

Race condition in the ns_client structure management in ISC BIND 9.9.x before 9.9.1-P2 allows remote attackers to cause a denial of service (memory consumption or process exit) via a large volume of TCP queries.

CVSS 2.0 · 4.3 Medium EPSS 2.7% KEV · Not listed

Vendors

Isc

Products

Bind

CVE-2012-4244

bind: specially crafted resource record causes named to exit

ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P3 allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a long resource record.

CVSS 2.0 · 7.8 High EPSS 35.2% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux Rhel Els

CVE-2012-5166

bind: Specially crafted DNS data can cause a lockup in named

ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.

CVSS 2.0 · 7.8 High EPSS 32.7% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux Rhel Els

CVE-2012-5688

bind: DoS on servers using DNS64

ISC BIND 9.8.x before 9.8.4-P1 and 9.9.x before 9.9.2-P1, when DNS64 is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.

CVSS 2.0 · 7.8 High EPSS 10.9% KEV · Not listed

Vendors

Canonical Isc Redhat

Products

Ubuntu Linux Bind Enterprise Linux

CVE-2012-5689

bind: denial of service when processing queries and with both DNS64 and RPZ enabled

ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record.

CVSS 2.0 · 7.1 High EPSS 12.1% KEV · Not listed

Vendors

Canonical Isc Redhat

Products

Ubuntu Linux Bind Enterprise Linux and 6 more

CVE-2013-2266

bind: libdns regular expressions excessive resource consumption DoS

libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running a named process.

CVSS 2.0 · 7.8 High EPSS 42.9% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux

CVE-2013-3919

bind: Querying a recursive resolver for a malformed zone causes named to crash

resolver.c in ISC BIND 9.8.5 before 9.8.5-P1, 9.9.3 before 9.9.3-P1, and 9.6-ESV-R9 before 9.6-ESV-R9-P1, when a recursive resolver is configured, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a record in a malformed zone.

CVSS 2.0 · 7.8 High EPSS 5.1% KEV · Not listed

Vendors

Isc

Products

Bind

CVE-2013-6230

bind: localnets ACL bypass caused by WinSock API bug

The Winsock WSAIoctl API in Microsoft Windows Server 2008, as used in ISC BIND 9.6-ESV before 9.6-ESV-R10-P1, 9.8 before 9.8.6-P1, 9.9 before 9.9.4-P1, 9.9.3-S1, 9.9.4-S1, and other products, does not properly support the SIO_GET_INTERFACE_LIST command for netmask 255.255.255.255, which allows remote attackers to bypass intended IP address restrictions by leveraging misinterpretation of this netmask as a 0.0.0.0 netmask.

CVSS 2.0 · 6.8 Medium EPSS 5.7% KEV · Not listed

Vendors

Isc

Products

Bind