#VU33961 Input validation error in ISC BIND - CVE-2011-4313

Vulnerability identifier: #VU33961

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-4313

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
ISC BIND
Server applications / DNS servers

Vendor: ISC

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver.

Mitigation
Install update from vendor's website.

Vulnerable software versions

ISC BIND: 9.0.0 rc1 - 9.6

---

External links
https://blogs.oracle.com/sunsecurity/entry/cve_2011_4313_denial_of
https://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-November/069463.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-November/069970.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-November/069975.html
https://lists.opensuse.org/opensuse-security-announce/2011-11/msg00027.html
https://lists.opensuse.org/opensuse-security-announce/2011-11/msg00028.html
https://lists.opensuse.org/opensuse-security-announce/2011-11/msg00029.html
https://marc.info/?l=bugtraq&m=132310123002302&w=2
https://marc.info/?l=bugtraq&m=133978480208466&w=2
https://marc.info/?l=bugtraq&m=141879471518471&w=2
https://osvdb.org/77159
https://secunia.com/advisories/46536
https://secunia.com/advisories/46829
https://secunia.com/advisories/46887
https://secunia.com/advisories/46890
https://secunia.com/advisories/46905
https://secunia.com/advisories/46906
https://secunia.com/advisories/46943
https://secunia.com/advisories/46984
https://secunia.com/advisories/47043
https://secunia.com/advisories/47075
https://secunia.com/advisories/48308
https://security.freebsd.org/advisories/FreeBSD-SA-11:06.bind.asc
https://support.apple.com/kb/HT5501
https://www.debian.org/security/2011/dsa-2347
https://www.ibm.com/support/docview.wss?uid=isg1IV11248
https://www.isc.org/software/bind/advisories/cve-2011-4313
https://www.kb.cert.org/vuls/id/606539
https://www.mandriva.com/security/advisories?name=MDVSA-2011:176
https://www.redhat.com/support/errata/RHSA-2011-1458.html
https://www.redhat.com/support/errata/RHSA-2011-1459.html
https://www.redhat.com/support/errata/RHSA-2011-1496.html
https://www.securityfocus.com/bid/50690
https://www.securitytracker.com/id?1026335
https://www.ubuntu.com/usn/USN-1264-1
https://www-01.ibm.com/support/docview.wss?uid=isg1IV11106
https://exchange.xforce.ibmcloud.com/vulnerabilities/71332
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14343

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.