CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

ISC : Security Vulnerabilities (CVSS score between 5 and 5.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2012-3570 119 DoS Overflow 2012-07-25 2013-04-10
5.7
 None Local Network Medium Not required None None Complete
Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and daemon exit) via a crafted client identifier parameter.
2 CVE-2012-1033 2012-02-08 2013-01-03
5.0
 None Remote Low Not required None Partial None
The resolver in ISC BIND 9 through 9.8.1-P1 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
3 CVE-2011-4539 20 DoS 2011-12-08 2012-11-06
5.0
 None Remote Low Not required None None Partial
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.
4 CVE-2011-4313 DoS 2011-11-29 2012-11-06
5.0
 None Remote Low Not required None None Partial
query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver.
5 CVE-2011-2464 DoS 2011-07-08 2012-08-13
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in ISC BIND 9 9.6.x before 9.6-ESV-R4-P3, 9.7.x before 9.7.3-P3, and 9.8.x before 9.8.0-P4 allows remote attackers to cause a denial of service (named daemon crash) via a crafted UPDATE request.
6 CVE-2011-1910 189 DoS 2011-05-31 2011-10-20
5.0
 None Remote Low Not required None None Partial
Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before 9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R4-P1 allows remote DNS servers to cause a denial of service (assertion failure and daemon exit) via a negative response containing large RRSIG RRsets.
7 CVE-2011-1907 399 DoS 2011-05-09 2011-09-06
5.0
 None Remote Low Not required None None Partial
ISC BIND 9.8.x before 9.8.0-P1, when Response Policy Zones (RPZ) RRset replacement is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an RRSIG query.
8 CVE-2010-3616 20 DoS 2010-12-17 2011-01-19
5.0
 None Remote Low Not required None None Partial
ISC DHCP server 4.2 before 4.2.0-P2, when configured to use failover partnerships, allows remote attackers to cause a denial of service (communications-interrupted state and DHCP client service loss) by connecting to a port that is only intended for a failover peer, as demonstrated by a Nagios check_tcp process check to TCP port 520.
9 CVE-2010-3615 264 2010-12-06 2011-01-12
5.0
 None Remote Low Not required Partial None None
named in ISC BIND 9.7.2-P2 does not check all intended locations for allow-query ACLs, which might allow remote attackers to make successful requests for private DNS records via the standard DNS query mechanism.
10 CVE-2010-2156 189 1 DoS 2010-06-07 2010-07-13
5.0
 None Remote Low Not required None None Partial
ISC DHCP 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1 allows remote attackers to cause a denial of service (server exit) via a zero-length client ID.
11 CVE-2010-0218 264 +Info 2010-10-05 2010-10-06
5.0
 None Remote Low Not required Partial None None
ISC BIND 9.7.2 through 9.7.2-P1 uses an incorrect ACL to restrict the ability of Recursion Desired (RD) queries to access the cache, which allows remote attackers to obtain potentially sensitive information via a DNS query.
12 CVE-2009-1892 16 DoS 2009-07-17 2009-12-19
5.0
 None Remote Low Not required None None Partial
dhcpd in ISC DHCP 3.0.4 and 3.1.1, when the dhcp-client-identifier and hardware ethernet configuration settings are both used, allows remote attackers to cause a denial of service (daemon crash) via unspecified requests.
13 CVE-2009-0265 287 Bypass 2009-01-26 2009-02-20
5.0
 None Remote Low Not required Partial None None
Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077 and CVE-2009-0025.
14 CVE-2009-0025 287 Bypass 2009-01-07 2012-10-30
5.0
 None Remote Low Not required Partial None None
BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
15 CVE-2007-2925 2007-07-24 2008-09-05
5.8
 None Remote Medium Not required Partial Partial None
The default access control lists (ACL) in ISC BIND 9.4.0, 9.4.1, and 9.5.0a1 through 9.5.0a5 do not set the allow-recursion and allow-query-cache ACLs, which allows remote attackers to make recursive queries and query the cache.
16 CVE-2006-4096 DoS 2006-09-05 2010-09-15
5.0
 None Remote Low Not required None None Partial
BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via a flood of recursive queries, which cause an INSIST failure when the response is received after the recursion queue is empty.
17 CVE-2006-4095 DoS 2006-09-05 2010-09-15
5.0
 None Remote Low Not required None None Partial
BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via certain SIG queries, which cause an assertion failure when multiple RRsets are returned.
18 CVE-2006-3122 399 DoS 2006-08-09 2011-06-13
5.0
 None Remote Low Not required None None Partial
The supersede_lease function in memory.c in ISC DHCP (dhcpd) server 2.0pl5 allows remote attackers to cause a denial of service (application crash) via a DHCPDISCOVER packet with a 32 byte client-identifier, which causes the packet to be interpreted as a corrupt uid and causes the server to exit with "corrupt lease uid."
19 CVE-2006-2073 DoS 2006-04-27 2008-09-05
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in ISC BIND allows remote attackers to cause a denial of service via a crafted DNS message with a "broken" TSIG, as demonstrated by the OUSPG PROTOS DNS test suite.
20 CVE-2006-0987 DoS 2006-03-03 2008-09-05
5.0
 None Remote Low Not required None None Partial
The default configuration of ISC BIND, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.
21 CVE-2005-0033 DoS Overflow 2005-05-02 2008-09-05
5.0
 None Remote Low Not required None None Partial
Buffer overflow in the code for recursion and glue fetching in BIND 8.4.4 and 8.4.5 allows remote attackers to cause a denial of service (crash) via queries that trigger the overflow in the q_usedns array that tracks nameservers and addresses.
22 CVE-2003-0039 DoS 2003-02-07 2008-09-05
5.0
 None Remote Low Not required None None Partial
ISC dhcrelay (dhcp-relay) 3.0rc9 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (packet storm) via a certain BOOTP packet that is forwarded to a broadcast MAC address, causing an infinite loop that is not restricted by a hop count.
23 CVE-2002-2213 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None Partial None
The DNS resolver in unspecified versions of Infoblox DNS One, when resolving recursive DNS queries for arbitrary hosts, allows remote attackers to conduct DNS cache poisoning via a birthday attack that uses a large number of open queries for the same resource record (RR) combined with spoofed responses, which increases the possibility of successfully spoofing a response in a way that is more efficient than brute force methods.
24 CVE-2002-2212 2002-12-31 2008-09-05
5.0
 None Remote Low Not required None Partial None
The DNS resolver in unspecified versions of Fujitsu UXP/V, when resolving recursive DNS queries for arbitrary hosts, allows remote attackers to conduct DNS cache poisoning via a birthday attack that uses a large number of open queries for the same resource record (RR) combined with spoofed responses, which increases the possibility of successfully spoofing a response in a way that is more efficient than brute force methods.
25 CVE-2002-2211 2002-12-31 2010-08-21
5.0
 None Remote Low Not required None Partial None
BIND 4 and BIND 8, when resolving recursive DNS queries for arbitrary hosts, allows remote attackers to conduct DNS cache poisoning via a birthday attack that uses a large number of open queries for the same resource record (RR) combined with spoofed responses, which increases the possibility of successfully spoofing a response in a way that is more efficient than brute force methods.
26 CVE-2002-1221 DoS 2002-11-29 2008-09-10
5.0
 None Remote Low Not required None None Partial
BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference.
27 CVE-2002-1220 DoS 2002-11-29 2008-09-10
5.0
 None Remote Low Not required None None Partial
BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size.
28 CVE-2002-0400 DoS 2002-06-18 2008-09-10
5.0
 None Remote Low Not required None None Partial
ISC BIND 9 before 9.2.1 allows remote attackers to cause a denial of service (shutdown) via a malformed DNS packet that triggers an error condition that is not properly handled when the rdataset parameter to the dns_message_findtype() function in message.c is not NULL, aka DoS_findtype.
29 CVE-2001-0012 2001-02-12 2008-09-10
5.0
 None Remote Low Not required Partial None None
BIND 4 and BIND 8 allow remote attackers to access sensitive information such as environment variables.
30 CVE-2000-0887 DoS 2000-12-19 2008-09-05
5.0
 None Remote Low Not required None None Partial
named in BIND 8.2 through 8.2.2-P6 allows remote attackers to cause a denial of service by making a compressed zone transfer (ZXFR) request and performing a name service query on an authoritative record that is not cached, aka the "zxfr bug."
31 CVE-2000-0360 DoS Overflow 2000-10-20 2008-09-10
5.0
 None Remote Low Not required None None Partial
Buffer overflow in INN 2.2.1 and earlier allows remote attackers to cause a denial of service via a maliciously formatted article.
32 CVE-1999-0849 DoS 1999-11-10 2008-09-09
5.0
 None Remote Low Not required None None Partial
Denial of service in BIND named via maxdname.
33 CVE-1999-0848 DoS 1999-11-10 2008-09-09
5.0
 None Remote Low Not required None None Partial
Denial of service in BIND named via consuming more than "fdmax" file descriptors.
34 CVE-1999-0024 1997-08-13 2008-09-09
5.0
 None Remote Low Not required None Partial None
DNS cache poisoning via BIND, by predictable query IDs.
35 CVE-1999-0010 DoS 1998-04-08 2008-09-09
5.0
 None Remote Low Not required None None Partial
Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages.
Total number of vulnerabilities : 35   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.