Input validation error in ISC BIND

1) Input validation error

EUVDB-ID: #VU33930

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2012-5166

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ISC BIND: 4.9.2 - 9.7.6-P3

External links

http://aix.software.ibm.com/aix/efixes/security/bind9_advisory5.asc
http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090346.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090491.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090586.html
http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00013.html
http://osvdb.org/86118
http://rhn.redhat.com/errata/RHSA-2012-1363.html
http://rhn.redhat.com/errata/RHSA-2012-1364.html
http://rhn.redhat.com/errata/RHSA-2012-1365.html
http://secunia.com/advisories/50903
http://secunia.com/advisories/50909
http://secunia.com/advisories/50956
http://secunia.com/advisories/51054
http://secunia.com/advisories/51078
http://secunia.com/advisories/51096
http://secunia.com/advisories/51106
http://secunia.com/advisories/51178
http://support.apple.com/kb/HT5880
http://www.debian.org/security/2012/dsa-2560
http://www.ibm.com/support/docview.wss?uid=isg1IV30185
http://www.ibm.com/support/docview.wss?uid=isg1IV30247
http://www.ibm.com/support/docview.wss?uid=isg1IV30364
http://www.ibm.com/support/docview.wss?uid=isg1IV30365
http://www.ibm.com/support/docview.wss?uid=isg1IV30366
http://www.ibm.com/support/docview.wss?uid=isg1IV30367
http://www.ibm.com/support/docview.wss?uid=isg1IV30368
http://www.isc.org/software/bind/advisories/cve-2012-5166
http://www.mandriva.com/security/advisories?name=MDVSA-2012:162
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/bid/55852
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.536004
http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
http://blogs.oracle.com/sunsecurity/entry/cve_2012_5166_denial_of
http://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488
http://kb.isc.org/article/AA-00801
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19706

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.