Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Bind vulnerabilities
Informations
Name USN-1462-1 First vendor Publication 2012-06-05
Vendor Ubuntu Last vendor Modification 2012-06-05
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:C)
Cvss Base Score 8.5 Attack Range Network
Cvss Impact Score 7.8 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.04 LTS - Ubuntu 8.04 LTS

Summary:

Bind could be made to crash if it received specially crafted network traffic.

Software Description: - bind9: Internet Domain Name Server

Details:

Dan Luther discovered that Bind incorrectly handled zero length rdata fields. A remote attacker could use this flaw to cause Bind to crash or behave erratically, resulting in a denial of service. (CVE-2012-1667)

It was discovered that Bind incorrectly handled revoked domain names. A remote attacker could use this flaw to cause malicious domain names to be continuously resolvable even after they have been revoked. (CVE-2012-1033)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04 LTS:
libdns81 1:9.8.1.dfsg.P1-4ubuntu0.1

Ubuntu 11.10:
libdns69 1:9.7.3.dfsg-1ubuntu4.2

Ubuntu 11.04:
libdns69 1:9.7.3.dfsg-1ubuntu2.4

Ubuntu 10.04 LTS:
libdns64 1:9.7.0.dfsg.P1-1ubuntu0.5

Ubuntu 8.04 LTS:
libdns36 1:9.4.2.dfsg.P2-2ubuntu0.10

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1462-1
CVE-2012-1033, CVE-2012-1667

Package Information:
https://launchpad.net/ubuntu/+source/bind9/1:9.8.1.dfsg.P1-4ubuntu0.1
https://launchpad.net/ubuntu/+source/bind9/1:9.7.3.dfsg-1ubuntu4.2
https://launchpad.net/ubuntu/+source/bind9/1:9.7.3.dfsg-1ubuntu2.4
https://launchpad.net/ubuntu/+source/bind9/1:9.7.0.dfsg.P1-1ubuntu0.5
https://launchpad.net/ubuntu/+source/bind9/1:9.4.2.dfsg.P2-2ubuntu0.10

Original Source

Url : http://www.ubuntu.com/usn/USN-1462-1

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-189 Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17645
 
Oval ID: oval:org.mitre.oval:def:17645
Title: USN-1462-1 -- bind9 vulnerabilities
Description: Bind could be made to crash if it received specially crafted network traffic.
Family: unix Class: patch
Reference(s): USN-1462-1
CVE-2012-1667
CVE-2012-1033
Version: 5
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04
Ubuntu 10.04
Ubuntu 8.04
Product(s): bind9
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18595
 
Oval ID: oval:org.mitre.oval:def:18595
Title: DSA-2486-1 bind9 - denial of service
Description: It was discovered that BIND, a DNS server, can crash while processing resource records containing no data bytes. Both authoritative servers and resolvers are affected.
Family: unix Class: patch
Reference(s): DSA-2486-1
CVE-2012-1667
Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
Product(s): bind9
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19815
 
Oval ID: oval:org.mitre.oval:def:19815
Title: HP-UX Running BIND, Remote Denial of Service (DoS), Authentication Bypass
Description: ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.
Family: unix Class: vulnerability
Reference(s): CVE-2012-1667
Version: 11
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19901
 
Oval ID: oval:org.mitre.oval:def:19901
Title: HP-UX Running BIND, Remote Domain Name Revalidation
Description: The resolver in ISC BIND 9 through 9.8.1-P1 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
Family: unix Class: vulnerability
Reference(s): CVE-2012-1033
Version: 11
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20624
 
Oval ID: oval:org.mitre.oval:def:20624
Title: VMware security updates for vSphere API and ESX Service Console
Description: The resolver in ISC BIND 9 through 9.8.1-P1 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
Family: unix Class: vulnerability
Reference(s): CVE-2012-1033
Version: 4
Platform(s): VMWare ESX Server 4.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20745
 
Oval ID: oval:org.mitre.oval:def:20745
Title: VMware security updates for vSphere API and ESX Service Console
Description: ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.
Family: unix Class: vulnerability
Reference(s): CVE-2012-1667
Version: 4
Platform(s): VMWare ESX Server 4.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20815
 
Oval ID: oval:org.mitre.oval:def:20815
Title: Vulnerability in AIX bind
Description: ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.
Family: unix Class: vulnerability
Reference(s): CVE-2012-1667
Version: 4
Platform(s): IBM AIX 6.1
IBM AIX 7.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21280
 
Oval ID: oval:org.mitre.oval:def:21280
Title: RHSA-2012:0716: bind security update (Important)
Description: ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.
Family: unix Class: patch
Reference(s): RHSA-2012:0716-01
CESA-2012:0716
CVE-2012-1033
CVE-2012-1667
Version: 29
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
Product(s): bind
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21290
 
Oval ID: oval:org.mitre.oval:def:21290
Title: RHSA-2012:0717: bind97 security update (Important)
Description: ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.
Family: unix Class: patch
Reference(s): RHSA-2012:0717-00
CESA-2012:0717
CVE-2012-1033
CVE-2012-1667
Version: 29
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): bind97
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23234
 
Oval ID: oval:org.mitre.oval:def:23234
Title: ELSA-2012:0717: bind97 security update (Important)
Description: ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.
Family: unix Class: patch
Reference(s): ELSA-2012:0717-00
CVE-2012-1033
CVE-2012-1667
Version: 13
Platform(s): Oracle Linux 5
Product(s): bind97
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23354
 
Oval ID: oval:org.mitre.oval:def:23354
Title: DEPRECATED: ELSA-2012:0716: bind security update (Important)
Description: ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.
Family: unix Class: patch
Reference(s): ELSA-2012:0716-01
CVE-2012-1033
CVE-2012-1667
Version: 14
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): bind
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23407
 
Oval ID: oval:org.mitre.oval:def:23407
Title: ELSA-2012:0716: bind security update (Important)
Description: ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.
Family: unix Class: patch
Reference(s): ELSA-2012:0716-01
CVE-2012-1033
CVE-2012-1667
Version: 13
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): bind
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27821
 
Oval ID: oval:org.mitre.oval:def:27821
Title: DEPRECATED: ELSA-2012-0716 -- bind security update (important)
Description: [32:9.7.3-8.P3.3] - fix CVE-2012-1667 and CVE-2012-1033
Family: unix Class: patch
Reference(s): ELSA-2012-0716
CVE-2012-1033
CVE-2012-1667
Version: 4
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): bind
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27872
 
Oval ID: oval:org.mitre.oval:def:27872
Title: DEPRECATED: ELSA-2012-0717 -- bind97 security update (important)
Description: [32:9.7.0-10.P2.1] - fix CVE-2012-1667 and CVE-2012-1033
Family: unix Class: patch
Reference(s): ELSA-2012-0717
CVE-2012-1033
CVE-2012-1667
Version: 4
Platform(s): Oracle Linux 5
Product(s): bind97
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 269

OpenVAS Exploits

Date Description
2012-12-31 Name : Fedora Update for bind FEDORA-2012-19822
File : nvt/gb_fedora_2012_19822_bind_fc16.nasl
2012-12-14 Name : Fedora Update for bind FEDORA-2012-19830
File : nvt/gb_fedora_2012_19830_bind_fc17.nasl
2012-12-13 Name : SuSE Update for bind openSUSE-SU-2012:0722-1 (bind)
File : nvt/gb_suse_2012_0722_1.nasl
2012-11-16 Name : VMSA-2012-0016: VMware security updates for vSphere API and ESX Service Console
File : nvt/gb_VMSA-2012-0016.nasl
2012-10-23 Name : Fedora Update for bind FEDORA-2012-15981
File : nvt/gb_fedora_2012_15981_bind_fc16.nasl
2012-10-23 Name : Fedora Update for bind FEDORA-2012-15965
File : nvt/gb_fedora_2012_15965_bind_fc17.nasl
2012-10-03 Name : Fedora Update for bind FEDORA-2012-14030
File : nvt/gb_fedora_2012_14030_bind_fc16.nasl
2012-09-26 Name : Gentoo Security Advisory GLSA 201209-04 (bind)
File : nvt/glsa_201209_04.nasl
2012-09-25 Name : Fedora Update for bind FEDORA-2012-14106
File : nvt/gb_fedora_2012_14106_bind_fc17.nasl
2012-09-10 Name : Slackware Advisory SSA:2012-166-01 bind
File : nvt/esoft_slk_ssa_2012_166_01.nasl
2012-08-30 Name : Fedora Update for bind FEDORA-2012-11146
File : nvt/gb_fedora_2012_11146_bind_fc17.nasl
2012-08-30 Name : Fedora Update for bind FEDORA-2012-8968
File : nvt/gb_fedora_2012_8968_bind_fc17.nasl
2012-08-14 Name : Fedora Update for bind FEDORA-2012-11153
File : nvt/gb_fedora_2012_11153_bind_fc16.nasl
2012-08-10 Name : FreeBSD Ports: bind99
File : nvt/freebsd_bind990.nasl
2012-08-10 Name : Debian Security Advisory DSA 2486-1 (bind9)
File : nvt/deb_2486_1.nasl
2012-08-10 Name : FreeBSD Ports: FreeBSD
File : nvt/freebsd_FreeBSD17.nasl
2012-08-03 Name : Mandriva Update for bind MDVSA-2012:089 (bind)
File : nvt/gb_mandriva_MDVSA_2012_089.nasl
2012-07-30 Name : CentOS Update for bind CESA-2012:0716 centos5
File : nvt/gb_CESA-2012_0716_bind_centos5.nasl
2012-07-30 Name : CentOS Update for bind CESA-2012:0716 centos6
File : nvt/gb_CESA-2012_0716_bind_centos6.nasl
2012-07-30 Name : CentOS Update for bind97 CESA-2012:0717 centos5
File : nvt/gb_CESA-2012_0717_bind97_centos5.nasl
2012-06-19 Name : Fedora Update for bind FEDORA-2012-8946
File : nvt/gb_fedora_2012_8946_bind_fc16.nasl
2012-06-19 Name : Fedora Update for bind FEDORA-2012-8962
File : nvt/gb_fedora_2012_8962_bind_fc15.nasl
2012-06-08 Name : RedHat Update for bind97 RHSA-2012:0717-01
File : nvt/gb_RHSA-2012_0717-01_bind97.nasl
2012-06-08 Name : Ubuntu Update for bind9 USN-1462-1
File : nvt/gb_ubuntu_USN_1462_1.nasl
2012-06-08 Name : RedHat Update for bind RHSA-2012:0716-01
File : nvt/gb_RHSA-2012_0716-01_bind.nasl

Information Assurance Vulnerability Management (IAVM)

Date Description
2012-11-29 IAVM : 2012-A-0189 - Multiple Vulnerabilities in VMware ESXi 4.1 and ESX 4.1
Severity : Category I - VMSKEY : V0035032

Snort® IPS/IDS

Date Description
2014-01-10 dns zone transfer with zero-length rdata attempt
RuleID : 23608 - Revision : 3 - Type : PROTOCOL-DNS

Nessus® Vulnerability Scanner

Date Description
2017-04-21 Name : The remote OracleVM host is missing one or more security updates.
File : oraclevm_OVMSA-2017-0066.nasl - Type : ACT_GATHER_INFO
2016-06-22 Name : The remote OracleVM host is missing one or more security updates.
File : oraclevm_OVMSA-2016-0055.nasl - Type : ACT_GATHER_INFO
2016-02-29 Name : The remote VMware ESX / ESXi host is missing a security-related patch.
File : vmware_VMSA-2012-0016_remote.nasl - Type : ACT_GATHER_INFO
2015-09-18 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL13660.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_bind_20120814.nasl - Type : ACT_GATHER_INFO
2014-10-10 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL15481.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-316.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-382.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-383.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-296.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2012-84.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-0716.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-0717.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-2028.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_bind-120605.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_bind-120604.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote AIX host is missing a security patch.
File : aix_IV22554.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote AIX host is missing a security patch.
File : aix_IV22555.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote AIX host is missing a security patch.
File : aix_IV22556.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote AIX host is missing a security patch.
File : aix_IV22625.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote AIX host is missing a security patch.
File : aix_IV22557.nasl - Type : ACT_GATHER_INFO
2012-12-21 Name : The remote HP-UX host is missing a security-related patch.
File : hpux_PHNE_43369.nasl - Type : ACT_GATHER_INFO
2012-12-07 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2012-341-01.nasl - Type : ACT_GATHER_INFO
2012-11-16 Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2012-0016.nasl - Type : ACT_GATHER_INFO
2012-09-27 Name : The remote name server may be affected by a DNS integrity vulnerability.
File : bind9_990.nasl - Type : ACT_GATHER_INFO
2012-09-24 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201209-04.nasl - Type : ACT_GATHER_INFO
2012-09-20 Name : The remote host is missing a Mac OS X update that fixes multiple security vul...
File : macosx_SecUpd2012-004.nasl - Type : ACT_GATHER_INFO
2012-09-20 Name : The remote host is missing a Mac OS X update that fixes several security issues.
File : macosx_10_8_2.nasl - Type : ACT_GATHER_INFO
2012-09-20 Name : The remote host is missing a Mac OS X update that fixes multiple security vul...
File : macosx_10_7_5.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120607_bind97_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120607_bind_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-06-29 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2486.nasl - Type : ACT_GATHER_INFO
2012-06-28 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_fc5231b6c06611e1b5e0000c299b62e1.nasl - Type : ACT_GATHER_INFO
2012-06-18 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_bind-8169.nasl - Type : ACT_GATHER_INFO
2012-06-18 Name : The remote Fedora host is missing a security update.
File : fedora_2012-8946.nasl - Type : ACT_GATHER_INFO
2012-06-18 Name : The remote Fedora host is missing a security update.
File : fedora_2012-8962.nasl - Type : ACT_GATHER_INFO
2012-06-15 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2012-166-01.nasl - Type : ACT_GATHER_INFO
2012-06-14 Name : The remote Fedora host is missing a security update.
File : fedora_2012-8968.nasl - Type : ACT_GATHER_INFO
2012-06-11 Name : The remote name server may be affected by a denial of service / information d...
File : bind9_991_p1.nasl - Type : ACT_GATHER_INFO
2012-06-11 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-089.nasl - Type : ACT_GATHER_INFO
2012-06-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-0717.nasl - Type : ACT_GATHER_INFO
2012-06-08 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-0717.nasl - Type : ACT_GATHER_INFO
2012-06-08 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-0716.nasl - Type : ACT_GATHER_INFO
2012-06-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-0716.nasl - Type : ACT_GATHER_INFO
2012-06-06 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1462-1.nasl - Type : ACT_GATHER_INFO
2012-06-05 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_1ecc0d3fae8e11e1965b0024e88a8c98.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 12:00:10
  • Multiple Updates