CVE-1999-0009
published 1998-04-08CVE-1999-0009: Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases.
PriorityP342critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
29.01%
98.1th percentile
Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases.
Affected
74 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bsdi | bsd_os | — | — |
| bsdi | bsd_os | — | — |
| bsdi | bsd_os | — | — |
| caldera | openlinux | — | — |
| data_general | dg_ux | — | — |
| data_general | dg_ux | — | — |
| data_general | dg_ux | — | — |
| data_general | dg_ux | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
| nec | asl_ux_4800 | — | — |
| netbsd | netbsd | — | — |
| netbsd | netbsd | — | — |
| netbsd | netbsd | — | — |
| netbsd | netbsd | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- ·The Snort rule (SID 2100252) targets UDP port 53 only, but both exploit PoCs use TCP/53 (SOCK_STREAM). A UDP-only rule will miss TCP-based exploitation attempts. ↗
- ·The exploit includes multiple hardcoded return addresses for different BIND versions and Linux/FreeBSD platforms. Detection based solely on return address values will be incomplete; focus on the IQUERY opcode byte pattern instead. ↗
- ·The exploit supports an 'optimized' mode that changes the dlen calculation and return address used, meaning packet sizes will vary between optimized and non-optimized runs. Size-based detection alone is unreliable. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
GPL DNS named iquery attempt
suricata·2010-09-23
CVE-1999-0009 GPL DNS named iquery attempt
GPL DNS named iquery attempt
Rule: alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"GPL DNS named iquery attempt"; content:"|09 80 00 00 00 01 00 00 00 00|"; depth:16; offset:2; reference:bugtraq,134; reference:cve,1999-0009; reference:url,www.rfc-editor.org/rfc/rfc1035.txt; classtype:attempted-recon; sid:2100252; rev:9; metadata:created_at 2010_09_23, cve CVE_1999_0009, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)
Exploit-DB
ISC BIND (Linux/BSD) - Remote Buffer Overflow (1)
exploitdb·1998-04-08
CVE-1999-0009 ISC BIND (Linux/BSD) - Remote Buffer Overflow (1)
ISC BIND (Linux/BSD) - Remote Buffer Overflow (1)
---
/*
source: https://www.securityfocus.com/bid/134/info
A buffer overflow exists in certain versions of BIND, the nameserver daemon currently maintained by the Internet Software Consortium (ISC). BIND fails to properly bound the data recieved when processing an inverse query. Upon a memory copy, portions of the program can be overwritten, and arbitrary commands run on the affected host.
Exploits for this vulnerability are very widespread, and were posted to the Bugtraq mailing list.
*/
/*
* have fun.
* -ROTShB
*/
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define DEFAULT_TARGET 0
#define DEFAULT_OPTIMIZATION 0
#define DEFAULT_ANBUF_OFFSET 300
#define DLEN_VAL
Exploit-DB
ISC BIND (Multiple OSes) - Remote Buffer Overflow (2)
exploitdb·1998-04-08
CVE-1999-0009 ISC BIND (Multiple OSes) - Remote Buffer Overflow (2)
ISC BIND (Multiple OSes) - Remote Buffer Overflow (2)
---
/*
source: https://www.securityfocus.com/bid/134/info
A buffer overflow exists in certain versions of BIND, the nameserver daemon currently maintained by the Internet Software Consortium (ISC). BIND fails to properly bound the data recieved when processing an inverse query. Upon a memory copy, portions of the program can be overwritten, and arbitrary commands run on the affected host.
Exploits for this vulnerability are very widespread, and were posted to the Bugtraq mailing list.
*/
/*
* z, thnx.
* ganked the xterm exec from adm, thnx.
* have fun.
* -prym
*/
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define REMOTE
#define DEFAULT_ANBUF_OFFSET 300
#def
No writeups or analysis indexed.
ftp://patches.sgi.com/support/free/security/advisories/19980603-01-PXhttp://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/180http://www.securityfocus.com/bid/134http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX9808-083ftp://patches.sgi.com/support/free/security/advisories/19980603-01-PXhttp://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/180http://www.securityfocus.com/bid/134http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX9808-083
1998-04-08
Published