ISC BIND 9 DNSSEC Validation Remote Denial of Service Vulnerability

Bugtraq ID:	45385
Class:	Unknown
CVE:	CVE-2010-3762
Remote:	Yes
Local:	No
Published:	Sep 28 2010 12:00AM
Updated:	Mar 19 2015 08:35AM
Credit:	Reported by vendor.
Vulnerable:	VMWare ESX Server 4.1 VMWare ESX Server 4.0 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 RedHat Enterprise Linux Desktop Workstation 5 client Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 ISC BIND 9.7.1-P2 ISC BIND 9.7.1 P1 ISC BIND 9.7.1 Avaya Voice Portal 5.1.1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 SP2 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya IQ 5.1 Avaya IQ 5 Avaya Aura System Platform 6.0.2 Avaya Aura System Platform 6.0.1 Avaya Aura System Platform 6.0 Avaya Aura System Platform 1.1 Avaya Aura System Manager 6.1.3 Avaya Aura System Manager 6.1.2 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 SP2 Avaya Aura System Manager 6.1 Sp1 Avaya Aura System Manager 6.1 Avaya Aura System Manager 6.0 SP1 Avaya Aura System Manager 6.0 Avaya Aura System Manager 5.2 Avaya Aura Session Manager 6.1.1 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0 SP1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1 Avaya Aura Presence Services 6.1.1 Avaya Aura Presence Services 6.1 Avaya Aura Presence Services 6.0 Avaya Aura Communication Manager 6.0.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Communication Manager 6.0 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700
Not Vulnerable:	VMWare ESX Server 4.0 ESX400-201103407

ISC BIND 9 DNSSEC Validation Remote Denial of Service Vulnerability

ISC BIND is prone to a remote denial-of-service vulnerability because the software fails to handle certain bad signatures in a DNS query.

An attacker can exploit this issue to cause the application to crash, denying service to legitimate users.

Versions prior to BIND 9.7.2-P2 are vulnerable.

ISC BIND 9 DNSSEC Validation Remote Denial of Service Vulnerability

An attacker can use readily available network utilities.

ISC BIND 9 DNSSEC Validation Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva bind-9.7.2-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-devel-9.7.2-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-doc-9.7.2-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-utils-9.7.2-0.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.0

• Mandriva bind-9.6.2-0.2mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-devel-9.6.2-0.2mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-doc-9.6.2-0.2mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-utils-9.6.2-0.2mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva bind-9.6.2-0.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-devel-9.6.2-0.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-doc-9.6.2-0.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-utils-9.6.2-0.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva bind-9.6.2-0.2mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-devel-9.6.2-0.2mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-doc-9.6.2-0.2mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-utils-9.6.2-0.2mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva bind-9.6.2-0.2mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-devel-9.6.2-0.2mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-doc-9.6.2-0.2mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-utils-9.6.2-0.2mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.0 x86_64

• Mandriva bind-9.6.2-0.2mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-devel-9.6.2-0.2mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-doc-9.6.2-0.2mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-utils-9.6.2-0.2mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.1

• Mandriva bind-9.7.2-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-devel-9.7.2-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-doc-9.7.2-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-utils-9.7.2-0.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0

• Mandriva bind-9.6.2-0.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-devel-9.6.2-0.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-doc-9.6.2-0.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-utils-9.6.2-0.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0

• Mandriva bind-9.4.3-0.3.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-devel-9.4.3-0.3.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva bind-utils-9.4.3-0.3.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/

ISC BIND 9 DNSSEC Validation Remote Denial of Service Vulnerability

References:

• BIND 9.7.2-P2 Release Notes (ISC)
  
• CVE-2010-3762 (Red Hat)
  
• ISC BIND Homepage (ISC)
  
• sol15172: BIND vulnerability CVE-2010-3762 (F5 Networks)
  
• ASA-2011-004 bind security update (RHSA-2010-0976) (Avaya)
  
• VMWare Security Advisory: VMSA-2011-0004 (VMWare)