ISC BIND 'allow-query' Zone ACL Security Bypass Vulnerability

Bugtraq ID:	45134
Class:	Design Error
CVE:	CVE-2010-3615
Remote:	Yes
Local:	No
Published:	Dec 01 2010 12:00AM
Updated:	Apr 13 2015 08:55PM
Credit:	ISC
Vulnerable:	Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 9.0 Slackware Linux 8.1 Slackware Linux x86_64 -current Slackware Linux 13.1 x86_64 Slackware Linux 13.1 Slackware Linux 13.0 x86_64 Slackware Linux 13.0 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux 11.0 Slackware Linux -current ISC BIND 9.7.1-P2 ISC BIND 9.7.1 P1 ISC BIND 9.7.1 ISC BIND 9.7.0 P2 ISC BIND 9.7.0
Not Vulnerable:

ISC BIND 'allow-query' Zone ACL Security Bypass Vulnerability

ISC BIND is prone to a security-bypass vulnerability.

Successfully exploiting this issue allows remote attackers to bypass zone-and-view Access Control Lists (ACLs) to perform unintended queries.

Versions prior to BIND 9.7.2-P3 are vulnerable.

ISC BIND 'allow-query' Zone ACL Security Bypass Vulnerability

Attackers can exploit this issue with readily available tools.

ISC BIND 'allow-query' Zone ACL Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.


Slackware Linux 13.0 x86_64

• Slackware bind-9.4_ESV_R4-x86_64-1_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/package s/bind-9.4_ESV_R4-x86_64-1_slack13.0.txz

Slackware Linux 12.1

• Slackware bind-9.4_ESV_R4-i486-1_slack12.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/ bind-9.4_ESV_R4-i486-1_slack12.1.tgz

Slackware Linux x86_64 -current

• Slackware bind-9.7.2_P3-x86_64-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ n/bind-9.7.2_P3-x86_64-1.txz

Slackware Linux 12.0

• Slackware bind-9.4_ESV_R4-i486-1_slack12.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ bind-9.4_ESV_R4-i486-1_slack12.0.tgz

Slackware Linux -current

• Slackware bind-9.7.2_P3-i486-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/bi nd-9.7.2_P3-i486-1.txz

Slackware Linux 13.0

• Slackware bind-9.4_ESV_R4-i486-1_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/ bind-9.4_ESV_R4-i486-1_slack13.0.txz

Slackware Linux 12.2

• Slackware bind-9.4_ESV_R4-i486-1_slack12.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ bind-9.4_ESV_R4-i486-1_slack12.2.tgz

Slackware Linux 13.1 x86_64

• Slackware bind-9.4_ESV_R4-x86_64-1_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/package s/bind-9.4_ESV_R4-x86_64-1_slack13.1.txz

Slackware Linux 11.0

• Slackware bind-9.4_ESV_R4-i486-1_slack11.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/ bind-9.4_ESV_R4-i486-1_slack11.0.tgz

Slackware Linux 13.1

• Slackware bind-9.4_ESV_R4-i486-1_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/ bind-9.4_ESV_R4-i486-1_slack13.1.txz

Slackware Linux 10.0

• Slackware bind-9.4_ESV_R4-i486-1_slack10.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ bind-9.4_ESV_R4-i486-1_slack10.0.tgz

Slackware Linux 10.1

• Slackware bind-9.4_ESV_R4-i486-1_slack10.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/ bind-9.4_ESV_R4-i486-1_slack10.1.tgz

Slackware Linux 10.2

• Slackware bind-9.4_ESV_R4-i486-1_slack10.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/ bind-9.4_ESV_R4-i486-1_slack10.2.tgz

Slackware Linux 8.1

• Slackware bind-9.4_ESV_R4-i386-1_slack8.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/b ind-9.4_ESV_R4-i386-1_slack8.1.tgz

Slackware Linux 9.0

• Slackware bind-9.4_ESV_R4-i386-1_slack9.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/b ind-9.4_ESV_R4-i386-1_slack9.0.tgz

Slackware Linux 9.1

• Slackware bind-9.4_ESV_R4-i486-1_slack9.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/b ind-9.4_ESV_R4-i486-1_slack9.1.tgz

ISC BIND 'allow-query' Zone ACL Security Bypass Vulnerability

References:

• ISC BIND Homepage (ISC)
  
• BIND: allow-query processed incorrectly (ISC)