CVE-2010-0097

BIND DNSSEC NSEC/NSEC3 validation code could cause bogus NXDOMAIN responses

Published Jan 22, 2010 CVSS 2.0 · 4.3 Medium EPSS 9.4% KEV · Not listed
Description
ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta does not properly validate DNSSEC (1) NSEC and (2) NSEC3 records, which allows remote attackers to add the Authenticated Data (AD) flag to a forged NXDOMAIN response for an existing domain.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-2054-1 New bind9 packages fix cache poisoning
Debian DSA Debian DSA DSA-2054-2 New bind9 packages fix cache poisoning
EUVD EUVD EUVD-2010-0129 ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta does not properly validate DNSSEC (1) NSEC and (2) NSEC3 records, which allows remote attackers to add the Authenticated Data (AD) flag to a forged NXDOMAIN response for an existing domain.
Ubuntu USN Ubuntu USN USN-888-1 Bind vulnerabilities
References
Link Providers
ftp://ftp.sco.com/pub/unixware7/714/security/p535243_uw7/p535243b.txt cve-icon cve-icon
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034196.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034202.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html cve-icon cve-icon
http://marc.info/?l=bugtraq&m=127195582210247&w=2 cve-icon cve-icon
http://secunia.com/advisories/38169 cve-icon cve-icon
http://secunia.com/advisories/38219 cve-icon cve-icon
http://secunia.com/advisories/38240 cve-icon cve-icon
http://secunia.com/advisories/39334 cve-icon cve-icon
http://secunia.com/advisories/39582 cve-icon cve-icon
http://secunia.com/advisories/40086 cve-icon cve-icon
http://securitytracker.com/id?1023474 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021798.1-1 cve-icon cve-icon
http://support.apple.com/kb/HT5002 cve-icon cve-icon
http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0018 cve-icon cve-icon
http://www.debian.org/security/2010/dsa-2054 cve-icon cve-icon
http://www.kb.cert.org/vuls/id/360341 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2010:021 cve-icon cve-icon
http://www.osvdb.org/61853 cve-icon cve-icon
http://www.securityfocus.com/bid/37865 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-888-1 cve-icon cve-icon
http://www.vupen.com/english/advisories/2010/0176 cve-icon cve-icon
http://www.vupen.com/english/advisories/2010/0622 cve-icon cve-icon
http://www.vupen.com/english/advisories/2010/0981 cve-icon cve-icon
http://www.vupen.com/english/advisories/2010/1352 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=554851 cve-icon cve-icon
https://exchange.xforce.ibmcloud.com/vulnerabilities/55753 cve-icon cve-icon
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2010-0097 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12205 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7212 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7430 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9357 cve-icon cve-icon
https://rhn.redhat.com/errata/RHSA-2010-0062.html cve-icon cve-icon
https://rhn.redhat.com/errata/RHSA-2010-0095.html cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2010-0097 cve-icon
https://www.isc.org/advisories/CVE-2010-0097 cve-icon cve-icon
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
certcc
Published
Updated
Aug 7, 2024, 12:37 AM
Reserved
Dec 30, 2009, 12:00 AM
Status
Modified
Published
Jan 22, 2010, 10:00 PM
Modified
Jun 16, 2026, 11:15 PM
Severity
Moderate
Public date
Jan 19, 2010, 12:00 AM