7.6 - CVE-2010-0382

Executive Summary

Informations
Name	CVE-2010-0382	First vendor Publication	2010-01-22
Vendor	Cve	Last vendor Modification	2017-09-19

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:H/Au:N/C:C/I:C/A:C)
Cvss Base Score	7.6	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	High
Cvss Expoit Score	4.9	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0382

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11753

Oval ID:	oval:org.mitre.oval:def:11753
Title:	ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.
Description:	ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2010-0382	Version:	5
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section bind-utils is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-libbind-devel is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-devel is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-chroot is earlier than 30:9.3.6-4.P1.el5_4.2 AND caching-nameserver is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-sdb is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-libs is earlier than 30:9.3.6-4.P1.el5_4.2

Definition Id: oval:org.mitre.oval:def:11783

Oval ID:	oval:org.mitre.oval:def:11783
Title:	DSA-2054 bind9 -- DNS cache poisoning
Description:	Several cache-poisoning vulnerabilities have been discovered in BIND. These vulnerabilities apply only if DNSSEC validation is enabled and trust anchors have been installed, which is not the default. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2010-0097 BIND does not properly validate DNSSEC NSEC records, which allows remote attackers to add the Authenticated Data flag to a forged NXDOMAIN response for an existing domain. When processing crafted responses containing CNAME or DNAME records, BIND is subject to a DNS cache poisoning vulnerability, provided that DNSSEC validation is enabled and trust anchors have been installed. When processing certain responses containing out-of-bailiwick data, BIND is subject to a DNS cache poisoning vulnerability, provided that DNSSEC validation is enabled and trust anchors have been installed. In addition, this update introduce a more conservative query behavior in the presence of repeated DNSSEC validation failures, addressing the "roll over and die" phenomenon. The new version also supports the cryptographic algorithm used by the upcoming signed ICANN DNS root , and the NSEC3 secure denial of existence algorithm used by some signed top-level domains. This update is based on a new upstream version of BIND 9, 9.6-ESV-R1. Because of the scope of changes, extra care is recommended when installing the update. Due to ABI changes, new Debian packages are included, and the update has to be installed using "apt-get dist-upgrade".
Family:	unix	Class:	patch
Reference(s):	DSA-2054 CVE-2010-0097 CVE-2010-0290 CVE-2010-0382	Version:	7
Platform(s):	Debian GNU/Linux 5.0	Product(s):	bind9
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independent section Installed architecture is all AND bind9-doc is earlier than 9.6.ESV.R1+dfsg-0+lenny1 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section dnsutils is earlier than 9.6.ESV.R1+dfsg-0+lenny1 AND libbind-dev is earlier than 9.6.ESV.R1+dfsg-0+lenny1 AND bind9 is earlier than 9.6.ESV.R1+dfsg-0+lenny1 AND libisc52 is earlier than 9.6.ESV.R1+dfsg-0+lenny1 AND libbind9-50 is earlier than 9.6.ESV.R1+dfsg-0+lenny1 AND bind9utils is earlier than 9.6.ESV.R1+dfsg-0+lenny1 AND libdns55 is earlier than 9.6.ESV.R1+dfsg-0+lenny1 AND liblwres50 is earlier than 9.6.ESV.R1+dfsg-0+lenny1 AND lwresd is earlier than 9.6.ESV.R1+dfsg-0+lenny1 AND libisccfg50 is earlier than 9.6.ESV.R1+dfsg-0+lenny1 AND libisccc50 is earlier than 9.6.ESV.R1+dfsg-0+lenny1 AND bind9-host is earlier than 9.6.ESV.R1+dfsg-0+lenny1

Definition Id: oval:org.mitre.oval:def:13115

Oval ID:	oval:org.mitre.oval:def:13115
Title:	DSA-2054-2 bind9 -- DNS cache poisoning
Description:	This update restores the PID file location for bind to the location before the last security update. For reference, here is the original advisory text that explains the security problems fixed: Several cache-poisoning vulnerabilities have been discovered in BIND. These vulnerabilities are apply only if DNSSEC validation is enabled and trust anchors have been installed, which is not the default. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2010-0097 BIND does not properly validate DNSSEC NSEC records, which allows remote attackers to add the Authenticated Data flag to a forged NXDOMAIN response for an existing domain. CVE-2010-0290 When processing crafted responses containing CNAME or DNAME records, BIND is subject to a DNS cache poisoning vulnerability, provided that DNSSEC validation is enabled and trust anchors have been installed. CVE-2010-0382 When processing certain responses containing out-of-bailiwick data, BIND is subject to a DNS cache poisoning vulnerability, provided that DNSSEC validation is enabled and trust anchors have been installed. In addition, this update introduce a more conservative query behavior in the presence of repeated DNSSEC validation failures, addressing the "roll over and die" phenomenon. The new version also supports the cryptographic algorithm used by the upcoming signed ICANN DNS root, and the NSEC3 secure denial of existence algorithm used by some signed top-level domains. This update is based on a new upstream version of BIND 9, 9.6-ESV-R1. Because of the scope of changes, extra care is recommended when installing the update. Due to ABI changes, new Debian packages are included, and the update has to be installed using "apt-get dist-upgrade". For the stable distribution, these problems have been fixed in version 1:9.6.ESV.R1+dfsg-0+lenny2. The unstable distribution is not affected by the wrong PID file location. We recommend that you upgrade your bind9 packages.
Family:	unix	Class:	patch
Reference(s):	DSA-2054-2 CVE-2010-0097 CVE-2010-0290 CVE-2010-0382	Version:	7
Platform(s):	Debian GNU/Linux 5.0	Product(s):	bind9
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independet section Installed architecture is all AND ind9-doc DPKG is earlier than 9.6.ESV.R1+dfsg-0+lenny2 AND libbind-dev DPKG is earlier than 9.6.ESV.R1+dfsg-0+lenny2 AND libisccc50 DPKG is earlier than 9.6.ESV.R1+dfsg-0+lenny2 AND libisccc40 DPKG is earlier than 9.5.1.dfsg.P3-1+lenny1 AND libisc52 DPKG is earlier than 9.6.ESV.R1+dfsg-0+lenny2 AND libbind9-50 DPKG is earlier than 9.6.ESV.R1+dfsg-0+lenny2 AND libbind9-40 DPKG is earlier than 9.5.1.dfsg.P3-1+lenny1 AND ind9 DPKG is earlier than 9.6.ESV.R1+dfsg-0+lenny2 AND ind9utils DPKG is earlier than 9.6.ESV.R1+dfsg-0+lenny2 AND libdns55 DPKG is earlier than 9.6.ESV.R1+dfsg-0+lenny2 AND liblwres50 DPKG is earlier than 9.6.ESV.R1+dfsg-0+lenny2 AND liblwres40 DPKG is earlier than 9.5.1.dfsg.P3-1+lenny1 AND lwresd DPKG is earlier than 9.6.ESV.R1+dfsg-0+lenny2 AND libdns45 DPKG is earlier than 9.5.1.dfsg.P3-1+lenny1 AND libisc45 DPKG is earlier than 9.5.1.dfsg.P3-1+lenny1 AND ind9-host DPKG is earlier than 9.6.ESV.R1+dfsg-0+lenny2 AND nsutils DPKG is earlier than 9.6.ESV.R1+dfsg-0+lenny2 AND libisccfg50 DPKG is earlier than 9.6.ESV.R1+dfsg-0+lenny2 AND libisccfg40 DPKG is earlier than 9.5.1.dfsg.P3-1+lenny1

Definition Id: oval:org.mitre.oval:def:13187

Oval ID:	oval:org.mitre.oval:def:13187
Title:	DSA-2054-1 bind9 -- DNS cache poisoning
Description:	Several cache-poisoning vulnerabilities have been discovered in BIND. These vulnerabilities are apply only if DNSSEC validation is enabled and trust anchors have been installed, which is not the default. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2010-0097 BIND does not properly validate DNSSEC NSEC records, which allows remote attackers to add the Authenticated Data flag to a forged NXDOMAIN response for an existing domain. CVE-2010-0290 When processing crafted responses containing CNAME or DNAME records, BIND is subject to a DNS cache poisoning vulnerability, provided that DNSSEC validation is enabled and trust anchors have been installed. CVE-2010-0382 When processing certain responses containing out-of-bailiwick data, BIND is subject to a DNS cache poisoning vulnerability, provided that DNSSEC validation is enabled and trust anchors have been installed. In addition, this update introduce a more conservative query behavior in the presence of repeated DNSSEC validation failures, addressing the "roll over and die" phenomenon. The new version also supports the cryptographic algorithm used by the upcoming signed ICANN DNS root, and the NSEC3 secure denial of existence algorithm used by some signed top-level domains. This update is based on a new upstream version of BIND 9, 9.6-ESV-R1. Because of the scope of changes, extra care is recommended when installing the update. Due to ABI changes, new Debian packages are included, and the update has to be installed using "apt-get dist-upgrade". For the stable distribution, these problems have been fixed in version 1:9.6.ESV.R1+dfsg-0+lenny1. For the unstable distribution, these problems have been fixed in version 1:9.7.0.dfsg-1. We recommend that you upgrade your bind9 packages.
Family:	unix	Class:	patch
Reference(s):	DSA-2054-1 CVE-2010-0097 CVE-2010-0290 CVE-2010-0382	Version:	7
Platform(s):	Debian GNU/Linux 5.0	Product(s):	bind9
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independet section Installed architecture is all AND ind9-doc DPKG is earlier than 1:9.6.ESV.R1+dfsg-0+lenny1 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section libbind-dev DPKG is earlier than 1:9.6.ESV.R1+dfsg-0+lenny1 AND libisccc50 DPKG is earlier than 1:9.6.ESV.R1+dfsg-0+lenny1 AND libisc52 DPKG is earlier than 1:9.6.ESV.R1+dfsg-0+lenny1 AND libbind9-50 DPKG is earlier than 1:9.6.ESV.R1+dfsg-0+lenny1 AND ind9 DPKG is earlier than 1:9.6.ESV.R1+dfsg-0+lenny1 AND ind9utils DPKG is earlier than 1:9.6.ESV.R1+dfsg-0+lenny1 AND libdns55 DPKG is earlier than 1:9.6.ESV.R1+dfsg-0+lenny1 AND liblwres50 DPKG is earlier than 1:9.6.ESV.R1+dfsg-0+lenny1 AND libisccfg50 DPKG is earlier than 1:9.6.ESV.R1+dfsg-0+lenny1 AND nsutils DPKG is earlier than 1:9.6.ESV.R1+dfsg-0+lenny1 AND ind9-host DPKG is earlier than 1:9.6.ESV.R1+dfsg-0+lenny1 AND lwresd DPKG is earlier than 1:9.6.ESV.R1+dfsg-0+lenny1

Definition Id: oval:org.mitre.oval:def:20762

Oval ID:	oval:org.mitre.oval:def:20762
Title:	Multiple vulnerabilities in AIX BIND
Description:	ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2010-0382	Version:	6
Platform(s):	IBM AIX 6.1 IBM AIX 7.1	Product(s):
Definition Synopsis:
platforms IBM AIX 6.1 is installed AND IBM AIX 7.1 is installed AND filesets File Version Exists bos.net.tcp.client greater than or equal 5.3.12.0 AND bos.net.tcp.client less than or equal 5.3.12.5 OR File Version Exists bos.net.tcp.server greater than or equal 5.3.12.0 AND bos.net.tcp.server less than or equal 5.3.12.3 OR File Version Exists bos.net.tcp.client greater than or equal 6.1.5.0 AND bos.net.tcp.client less than or equal 6.1.5.7 OR File Version Exists bos.net.tcp.server greater than or equal 6.1.5.0 AND bos.net.tcp.server less than or equal 6.1.5.6 OR File Version Exists bos.net.tcp.client greater than or equal 6.1.6.0 AND bos.net.tcp.client less than or equal 6.1.6.16 OR File Version Exists bos.net.tcp.server greater than or equal 6.1.6.0 AND bos.net.tcp.server less than or equal 6.1.6.16 OR File Version Exists bos.net.tcp.client greater than or equal 6.1.7.0 AND bos.net.tcp.client less than or equal 6.1.7.1 OR File Version Exists bos.net.tcp.server greater than or equal 6.1.7.0 AND bos.net.tcp.server less than or equal 6.1.7.0 OR File Version Exists bos.net.tcp.client greater than or equal 7.1.0.0 AND bos.net.tcp.client less than or equal 7.1.0.17 OR File Version Exists bos.net.tcp.server greater than or equal 7.1.0.0 AND bos.net.tcp.server less than or equal 7.1.0.16 OR File Version Exists bos.net.tcp.client greater than or equal 7.1.1.0 AND bos.net.tcp.client less than or equal 7.1.1.1 OR File Version Exists bos.net.tcp.server greater than or equal 7.1.1.0 AND bos.net.tcp.server less than or equal 7.1.1.0

Definition Id: oval:org.mitre.oval:def:21912

Oval ID:	oval:org.mitre.oval:def:21912
Title:	RHSA-2010:0062: bind security update (Moderate)
Description:	ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.
Family:	unix	Class:	patch
Reference(s):	RHSA-2010:0062-02 CESA-2010:0062 CVE-2010-0097 CVE-2010-0290 CVE-2010-0382	Version:	42
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5	Product(s):	bind
Definition Synopsis:
Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages section bind-utils is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-devel is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-libbind-devel is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-chroot is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-sdb is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-libs is earlier than 30:9.3.6-4.P1.el5_4.2 AND caching-nameserver is earlier than 30:9.3.6-4.P1.el5_4.2

Definition Id: oval:org.mitre.oval:def:22749

Oval ID:	oval:org.mitre.oval:def:22749
Title:	ELSA-2010:0062: bind security update (Moderate)
Description:	ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.
Family:	unix	Class:	patch
Reference(s):	ELSA-2010:0062-02 CVE-2010-0097 CVE-2010-0290 CVE-2010-0382	Version:	17
Platform(s):	Oracle Linux 5	Product(s):	bind
Definition Synopsis:
Oracle Linux 5.x rpm test bind-utils is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-devel is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-libbind-devel is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-chroot is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-sdb is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind is earlier than 30:9.3.6-4.P1.el5_4.2 AND bind-libs is earlier than 30:9.3.6-4.P1.el5_4.2 AND caching-nameserver is earlier than 30:9.3.6-4.P1.el5_4.2

Definition Id: oval:org.mitre.oval:def:28008

Oval ID:	oval:org.mitre.oval:def:28008
Title:	DEPRECATED: ELSA-2010-0062 -- bind security update (moderate)
Description:	[30:9.3.6-4.P1.2] - NSEC validation code could cause wrong NXDOMAIN responses (#554851, CVE-2010-0097) - improve fix for CVE-2009-4022 (#538744) - {C,D}NAMEs could be returned to clients without proper DNSSEC validation - don't validate + cache out-of-bailiwick data returned with a secure answer. Refetch it instead.
Family:	unix	Class:	patch
Reference(s):	ELSA-2010-0062 CVE-2010-0097 CVE-2010-0290 CVE-2010-0382	Version:	4
Platform(s):	Oracle Linux 5	Product(s):	bind
Definition Synopsis:
Oracle Linux 5.x Packages match section bind is earlier than 0:9.3.6-4.P1.el5_4.2 AND bind-chroot is earlier than 0:9.3.6-4.P1.el5_4.2 AND bind-devel is earlier than 0:9.3.6-4.P1.el5_4.2 AND bind-libbind-devel is earlier than 0:9.3.6-4.P1.el5_4.2 AND bind-libs is earlier than 0:9.3.6-4.P1.el5_4.2 AND bind-sdb is earlier than 0:9.3.6-4.P1.el5_4.2 AND bind-utils is earlier than 0:9.3.6-4.P1.el5_4.2 AND caching-nameserver is earlier than 0:9.3.6-4.P1.el5_4.2

Definition Id: oval:org.mitre.oval:def:6665

Oval ID:	oval:org.mitre.oval:def:6665
Title:	HP-UX Running BIND, Remote Denial of Service (DoS), Unauthorized Disclosure of Information
Description:	ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2010-0382	Version:	6
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX02546 HP Release B.11.23 AND filesets tests BindUpgrade.BIND-UPGRADE version is less than C.9.3.2.7.0 AND BindUpgrade.BIND2-UPGRADE version is less than C.9.3.2.7.0 OR Criteria meets HP Security Bulletin HPSBUX02546 HP Release B.11.23 AND filesets tests InternetSrvcs.INETSVCS-INETD is installed AND InternetSrvcs.INETSVCS-RUN is installed AND InternetSrvcs.INETSVCS2-RUN is installed AND NOT Patch PHNE_40339 is installed OR Criteria meets HP Security Bulletin HPSBUX02546 HP Release B.11.11 AND BindUpgrade.BIND-UPGRADE version is less than C.9.3.2.7.0 OR Criteria meets HP Security Bulletin HPSBUX02546 HP Release B.11.11 AND BINDv920.INETSVCS-BIND version is less than B.11.11.01.015

Definition Id: oval:org.mitre.oval:def:7086

Oval ID:	oval:org.mitre.oval:def:7086
Title:	ISC BIND 9 Cache Poisoning Vulnerability
Description:	ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2010-0382	Version:	5
Platform(s):	VMWare ESX Server 4.0	Product(s):
Definition Synopsis:
VMware ESX Server 4.0 is installed AND Patch ESX400-201005408-SG is not installed

CPE : Common Platform Enumeration

Type	Description	Count
Application	Isc Bind cpe:2.3:a:isc:bind:9.7.0:b1:::-:::* cpe:2.3:a:isc:bind:9.6.1:rc1:::-:::* cpe:2.3:a:isc:bind:9.6.1:p2:::-:::* cpe:2.3:a:isc:bind:9.6.1:p1:::-:::* cpe:2.3:a:isc:bind:9.6.1::::-::: cpe:2.3:a:isc:bind:9.6.1:b1:::-:::* cpe:2.3:a:isc:bind:9.6.0:rc1:::-:::* cpe:2.3:a:isc:bind:9.6.0:rc2:::-:::* cpe:2.3:a:isc:bind:9.6.0:p1:::-:::* cpe:2.3:a:isc:bind:9.6.0::::-::: cpe:2.3:a:isc:bind:9.6.0:b1:::-:::* cpe:2.3:a:isc:bind:9.6.0:a1:::-:::* cpe:2.3:a:isc:bind:9.4.3:rc1:::-:::* cpe:2.3:a:isc:bind:9.4.3::::-::: cpe:2.3:a:isc:bind:9.4.3:p2:::-:::* cpe:2.3:a:isc:bind:9.4.3:b1:::-:::* cpe:2.3:a:isc:bind:9.4.3:b3:::-:::* cpe:2.3:a:isc:bind:9.4.3:b2:::-:::* cpe:2.3:a:isc:bind:9.4.3:p3:::-:::* cpe:2.3:a:isc:bind:9.4.3:p1:::-:::* cpe:2.3:a:isc:bind:9.4.3:p5:::-:::* cpe:2.3:a:isc:bind:9.4.3:p4:::-:::* cpe:2.3:a:isc:bind:9.4.2::::-::: cpe:2.3:a:isc:bind:9.4.2:rc1:::-:::* cpe:2.3:a:isc:bind:9.4.2:rc2:::-:::* cpe:2.3:a:isc:bind:9.4.1::::-::: cpe:2.3:a:isc:bind:9.4.0::::-::: cpe:2.3:a:isc:bind:9.4.0:rc1:::-:::* cpe:2.3:a:isc:bind:9.4.0:rc2:::-:::* cpe:2.3:a:isc:bind:9.4.0:a6:::-:::* cpe:2.3:a:isc:bind:9.4.0:a5:::-:::* cpe:2.3:a:isc:bind:9.4.0:b4:::-:::* cpe:2.3:a:isc:bind:9.4.0:b3:::-:::* cpe:2.3:a:isc:bind:9.4.0:b2:::-:::* cpe:2.3:a:isc:bind:9.4.0:b1:::-:::* cpe:2.3:a:isc:bind:9.4.0:a4:::-:::* cpe:2.3:a:isc:bind:9.4.0:a3:::-:::* cpe:2.3:a:isc:bind:9.4.0:a2:::-:::* cpe:2.3:a:isc:bind:9.4.0:a1:::-:::* cpe:2.3:a:isc:bind:9.4::::-::: cpe:2.3:a:isc:bind:9.3.6::::-::: cpe:2.3:a:isc:bind:9.3.6:rc1:::-:::* cpe:2.3:a:isc:bind:9.3.5::::-::: cpe:2.3:a:isc:bind:9.3.5:rc1:::-:::* cpe:2.3:a:isc:bind:9.3.5:rc2:::-:::* cpe:2.3:a:isc:bind:9.3.4::::-::: cpe:2.3:a:isc:bind:9.3.3::::-::: cpe:2.3:a:isc:bind:9.3.3:rc3:::-:::* cpe:2.3:a:isc:bind:9.3.3:rc1:::-:::* cpe:2.3:a:isc:bind:9.3.3:rc2:::-:::* cpe:2.3:a:isc:bind:9.3.2::::-::: cpe:2.3:a:isc:bind:9.3.2:rc1:::-:::* cpe:2.3:a:isc:bind:9.3.1::::-::: cpe:2.3:a:isc:bind:9.3.1:rc1:::-:::* cpe:2.3:a:isc:bind:9.3.1:b2:::-:::* cpe:2.3:a:isc:bind:9.3.0::::-::: cpe:2.3:a:isc:bind:9.3.0:rc1:::-:::* cpe:2.3:a:isc:bind:9.3.0:rc4:::-:::* cpe:2.3:a:isc:bind:9.3.0:rc3:::-:::* cpe:2.3:a:isc:bind:9.3.0:rc2:::-:::* cpe:2.3:a:isc:bind:9.3.0:b4:::-:::* cpe:2.3:a:isc:bind:9.3.0:b3:::-:::* cpe:2.3:a:isc:bind:9.3.0:b2:::-:::* cpe:2.3:a:isc:bind:9.3::::-::: cpe:2.3:a:isc:bind:9.2.9::::-::: cpe:2.3:a:isc:bind:9.2.9:rc1:::-:::* cpe:2.3:a:isc:bind:9.2.8::::-::: cpe:2.3:a:isc:bind:9.2.7::::-::: cpe:2.3:a:isc:bind:9.2.7:rc3:::-:::* cpe:2.3:a:isc:bind:9.2.7:rc1:::-:::* cpe:2.3:a:isc:bind:9.2.7:rc2:::-:::* cpe:2.3:a:isc:bind:9.2.6::::-::: cpe:2.3:a:isc:bind:9.2.6:rc1:::-:::* cpe:2.3:a:isc:bind:9.2.5::::-::: cpe:2.3:a:isc:bind:9.2.5:rc1:::-:::* cpe:2.3:a:isc:bind:9.2.5:b2:::-:::* cpe:2.3:a:isc:bind:9.2.4::::-::: cpe:2.3:a:isc:bind:9.2.4:rc7:::-:::* cpe:2.3:a:isc:bind:9.2.4:rc8:::-:::* cpe:2.3:a:isc:bind:9.2.4:rc2:::-:::* cpe:2.3:a:isc:bind:9.2.4:rc3:::-:::* cpe:2.3:a:isc:bind:9.2.4:rc6:::-:::* cpe:2.3:a:isc:bind:9.2.4:rc5:::-:::* cpe:2.3:a:isc:bind:9.2.4:rc4:::-:::* cpe:2.3:a:isc:bind:9.2.3::::-::: cpe:2.3:a:isc:bind:9.2.3:rc3:::-:::* cpe:2.3:a:isc:bind:9.2.3:rc1:::-:::* cpe:2.3:a:isc:bind:9.2.3:rc4:::-:::* cpe:2.3:a:isc:bind:9.2.3:rc2:::-:::* cpe:2.3:a:isc:bind:9.2.2::::-::: cpe:2.3:a:isc:bind:9.2.2:p3:::-:::* cpe:2.3:a:isc:bind:9.2.2:rc1:::-:::* cpe:2.3:a:isc:bind:9.2.2:p2:::-:::* cpe:2.3:a:isc:bind:9.2.1::::-::: cpe:2.3:a:isc:bind:9.2.1:rc1:::-:::* cpe:2.3:a:isc:bind:9.2.1:rc2:::-:::* cpe:2.3:a:isc:bind:9.2.0::::-::: cpe:2.3:a:isc:bind:9.2.0:rc4:::-:::* cpe:2.3:a:isc:bind:9.2.0:rc9:::-:::* cpe:2.3:a:isc:bind:9.2.0:rc5:::-:::* cpe:2.3:a:isc:bind:9.2.0:rc10:::-:::* cpe:2.3:a:isc:bind:9.2.0:rc3:::-:::* cpe:2.3:a:isc:bind:9.2.0:rc2:::-:::* cpe:2.3:a:isc:bind:9.2.0:rc1:::-:::* cpe:2.3:a:isc:bind:9.2.0:rc7:::-:::* cpe:2.3:a:isc:bind:9.2.0:rc6:::-:::* cpe:2.3:a:isc:bind:9.2.0:rc8:::-:::* cpe:2.3:a:isc:bind:9.2.0:b1:::-:::* cpe:2.3:a:isc:bind:9.2.0:a1:::-:::* cpe:2.3:a:isc:bind:9.2.0:b2:::-:::* cpe:2.3:a:isc:bind:9.2.0:a2:::-:::* cpe:2.3:a:isc:bind:9.2.0:a3:::-:::* cpe:2.3:a:isc:bind:9.2::::-::: cpe:2.3:a:isc:bind:9.10.3:b1:::::: cpe:2.3:a:isc:bind:9.10.3:::::::* cpe:2.3:a:isc:bind:9.10.3:rc1:::::: cpe:2.3:a:isc:bind:9.10.3:p3:::::: cpe:2.3:a:isc:bind:9.10.3:p2:::::: cpe:2.3:a:isc:bind:9.10.3:p1:::::: cpe:2.3:a:isc:bind:9.10.2:p3:::::: cpe:2.3:a:isc:bind:9.10.2:p2:::::: cpe:2.3:a:isc:bind:9.10.2:rc2:::::: cpe:2.3:a:isc:bind:9.10.2:rc1:::::: cpe:2.3:a:isc:bind:9.10.2:p4:::::: cpe:2.3:a:isc:bind:9.10.2:p1:::::: cpe:2.3:a:isc:bind:9.10.2:b1:::::: cpe:2.3:a:isc:bind:9.10.1:rc2:::::: cpe:2.3:a:isc:bind:9.10.1:rc1:::::: cpe:2.3:a:isc:bind:9.10.1:b2:::::: cpe:2.3:a:isc:bind:9.10.1:b1:::::: cpe:2.3:a:isc:bind:9.10.1:p2:::::: cpe:2.3:a:isc:bind:9.10.1:p1:::::: cpe:2.3:a:isc:bind:9.10.1:::::::* cpe:2.3:a:isc:bind:9.10.0:rc1:::::: cpe:2.3:a:isc:bind:9.10.0:p2:::::: cpe:2.3:a:isc:bind:9.10.0:b1:::::: cpe:2.3:a:isc:bind:9.10.0:a2:::::: cpe:2.3:a:isc:bind:9.10.0:p1:::::: cpe:2.3:a:isc:bind:9.10.0:b2:::::: cpe:2.3:a:isc:bind:9.10.0:rc2:::::: cpe:2.3:a:isc:bind:9.10.0:a1:::::: cpe:2.3:a:isc:bind:9.10.0:::::::* cpe:2.3:a:isc:bind:9.1.3::::-::: cpe:2.3:a:isc:bind:9.1.3:rc1:::-:::* cpe:2.3:a:isc:bind:9.1.3:rc2:::-:::* cpe:2.3:a:isc:bind:9.1.3:rc3:::-:::* cpe:2.3:a:isc:bind:9.1.2::::-::: cpe:2.3:a:isc:bind:9.1.2:rc1:::-:::* cpe:2.3:a:isc:bind:9.1.1::::-::: cpe:2.3:a:isc:bind:9.1.1:rc6:::-:::* cpe:2.3:a:isc:bind:9.1.1:rc7:::-:::* cpe:2.3:a:isc:bind:9.1.1:rc3:::-:::* cpe:2.3:a:isc:bind:9.1.1:rc2:::-:::* cpe:2.3:a:isc:bind:9.1.1:rc4:::-:::* cpe:2.3:a:isc:bind:9.1.1:rc5:::-:::* cpe:2.3:a:isc:bind:9.1.1:rc1:::-:::* cpe:2.3:a:isc:bind:9.1.0:rc1:::-:::* cpe:2.3:a:isc:bind:9.1::::-::: cpe:2.3:a:isc:bind:9.0.1::::-::: cpe:2.3:a:isc:bind:9.0.1:rc2:::-:::* cpe:2.3:a:isc:bind:9.0.1:rc1:::-:::* cpe:2.3:a:isc:bind:9.0.0:rc4:::-:::* cpe:2.3:a:isc:bind:9.0.0:rc5:::-:::* cpe:2.3:a:isc:bind:9.0.0:rc2:::-:::* cpe:2.3:a:isc:bind:9.0.0:rc6:::-:::* cpe:2.3:a:isc:bind:9.0.0:rc1:::-:::* cpe:2.3:a:isc:bind:9.0.0:rc3:::-:::* cpe:2.3:a:isc:bind:9.0::::-:::	168

OpenVAS Exploits

Date	Description
2012-04-16	Name : VMSA-2010-0009: ESXi utilities and ESX Service Console third party updates File : nvt/gb_VMSA-2010-0009.nasl
2011-03-09	Name : Gentoo Security Advisory GLSA 201006-11 (BIND) File : nvt/glsa_201006_11.nasl
2010-10-01	Name : HP-UX Update for BIND HPSBUX02546 File : nvt/gb_hp_ux_HPSBUX02546.nasl
2010-07-06	Name : Debian Security Advisory DSA 2054-2 (bind9) File : nvt/deb_2054_2.nasl
2010-06-10	Name : Debian Security Advisory DSA 2054-1 (bind9) File : nvt/deb_2054_1.nasl
2010-01-20	Name : ISC BIND 9 DNSSEC Bogus NXDOMAIN Response Remote Cache Poisoning Vulnerability File : nvt/bind_37865.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
62008	ISC BIND Secure Response Refetch Weakness Unspecified Issue

Nessus® Vulnerability Scanner

Date	Description
2016-03-08	Name : The remote VMware ESX / ESXi host is missing a security-related patch. File : vmware_VMSA-2010-0009_remote.nasl - Type : ACT_GATHER_INFO
2014-11-04	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL15787.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0062.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote AIX host is missing a security patch. File : aix_IV09978.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote AIX host is missing a security patch. File : aix_IV11744.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote AIX host is missing a security patch. File : aix_IV11743.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote AIX host is missing a security patch. File : aix_IV11742.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote AIX host is missing a security patch. File : aix_IV10049.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote AIX host is missing a security patch. File : aix_IV09491.nasl - Type : ACT_GATHER_INFO
2010-06-08	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2054.nasl - Type : ACT_GATHER_INFO
2010-06-07	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHNE_40339.nasl - Type : ACT_GATHER_INFO
2010-06-02	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201006-11.nasl - Type : ACT_GATHER_INFO
2010-06-01	Name : The remote VMware ESXi / ESX host is missing one or more security-related pat... File : vmware_VMSA-2010-0009.nasl - Type : ACT_GATHER_INFO
2010-01-21	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0062.nasl - Type : ACT_GATHER_INFO
2010-01-21	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-021.nasl - Type : ACT_GATHER_INFO
2010-01-21	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0062.nasl - Type : ACT_GATHER_INFO
2009-12-02	Name : The remote name server is affected by a cache poisoning vulnerability. File : bind9_dnssec_cache_poisoning.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
CONFIRM	http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0018 https://www.isc.org/advisories/CVE-2009-4022v6
DEBIAN	http://www.debian.org/security/2010/dsa-2054
OVAL	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova... https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova... https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
SECUNIA	http://secunia.com/advisories/40086
VUPEN	http://www.vupen.com/english/advisories/2010/0622 http://www.vupen.com/english/advisories/2010/1352

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-02-02 01:12:37	Multiple Updates
2024-02-01 12:03:28	Multiple Updates
2023-09-05 12:11:48	Multiple Updates
2023-09-05 01:03:20	Multiple Updates
2023-09-02 12:11:51	Multiple Updates
2023-09-02 01:03:22	Multiple Updates
2023-08-12 12:14:03	Multiple Updates
2023-08-12 01:03:21	Multiple Updates
2023-08-11 12:11:54	Multiple Updates
2023-08-11 01:03:29	Multiple Updates
2023-08-06 12:11:27	Multiple Updates
2023-08-06 01:03:23	Multiple Updates
2023-08-04 12:11:32	Multiple Updates
2023-08-04 01:03:25	Multiple Updates
2023-07-14 12:11:28	Multiple Updates
2023-07-14 01:03:23	Multiple Updates
2023-03-29 01:13:09	Multiple Updates
2023-03-28 12:03:29	Multiple Updates
2022-10-11 12:10:13	Multiple Updates
2022-10-11 01:03:11	Multiple Updates
2021-05-04 12:11:02	Multiple Updates
2021-04-22 01:11:37	Multiple Updates
2020-05-23 00:25:12	Multiple Updates
2017-09-19 09:23:37	Multiple Updates
2016-04-04 21:25:27	Multiple Updates
2016-03-09 13:25:54	Multiple Updates
2014-11-05 13:27:40	Multiple Updates
2014-02-17 10:53:36	Multiple Updates
2013-05-10 23:17:11	Multiple Updates

Global Informations

Type	Count
Oval ID(s)	10
CPE ID(s)	168
Sources(s)	9
osvdb(s)	1
Openvas Exploit(s)	6
Nessus® Exploit(s)	17

	Related
10	VMSA-2010-0009
7.6	HPSBUX02546 SSR...
7.6	GLSA-201006-11
7.6	DSA-2054
2.6	CVE-2009-4022
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 5 more Alert(s)

7.6 - CVE-2010-0382

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU