Input validation error in ISC BIND

1) Input validation error

EUVDB-ID: #VU33961

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-4313

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ISC BIND: 9.0.0 - 9.6

CPE2.3

• cpe:2.3:a:isc:isc_bind:9.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:isc:isc_bind:9.0.0a1:*:*:*:*:*:*:*
• cpe:2.3:a:isc:isc_bind:9.0.0a2:*:*:*:*:*:*:*

External links

https://blogs.oracle.com/sunsecurity/entry/cve_2011_4313_denial_of
https://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-November/069463.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-November/069970.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-November/069975.html
https://lists.opensuse.org/opensuse-security-announce/2011-11/msg00027.html
https://lists.opensuse.org/opensuse-security-announce/2011-11/msg00028.html
https://lists.opensuse.org/opensuse-security-announce/2011-11/msg00029.html
https://marc.info/?l=bugtraq&m=132310123002302&w=2
https://marc.info/?l=bugtraq&m=133978480208466&w=2
https://marc.info/?l=bugtraq&m=141879471518471&w=2
https://osvdb.org/77159
https://secunia.com/advisories/46536
https://secunia.com/advisories/46829
https://secunia.com/advisories/46887
https://secunia.com/advisories/46890
https://secunia.com/advisories/46905
https://secunia.com/advisories/46906
https://secunia.com/advisories/46943
https://secunia.com/advisories/46984
https://secunia.com/advisories/47043
https://secunia.com/advisories/47075
https://secunia.com/advisories/48308
https://security.freebsd.org/advisories/FreeBSD-SA-11:06.bind.asc
https://support.apple.com/kb/HT5501
https://www.debian.org/security/2011/dsa-2347
https://www.ibm.com/support/docview.wss?uid=isg1IV11248
https://www.isc.org/software/bind/advisories/cve-2011-4313
https://www.kb.cert.org/vuls/id/606539
https://www.mandriva.com/security/advisories?name=MDVSA-2011:176
https://www.redhat.com/support/errata/RHSA-2011-1458.html
https://www.redhat.com/support/errata/RHSA-2011-1459.html
https://www.redhat.com/support/errata/RHSA-2011-1496.html
https://www.securityfocus.com/bid/50690
https://www.securitytracker.com/id?1026335
https://www.ubuntu.com/usn/USN-1264-1
https://www-01.ibm.com/support/docview.wss?uid=isg1IV11106
https://exchange.xforce.ibmcloud.com/vulnerabilities/71332
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14343

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.