CVE-2009-0265 — Unchecked Return Value in Bind

CWE-252 — Unchecked Return ValueCWE-287 — Improper Authentication5 documents5 sources
Severity
7.5HIGHNVD
CNA5.8
EPSS
0.4%
top 39.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
ISC Bind
Timeline
PublishedJan 26
Latest updateMay 2

Description

Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077 and CVE-2009-0025.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDisc/bind9.6.0

Patches

Patch: slackware.com ↗Patch: slackware.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-mrwj-9mpp-w94q: Internet Systems Consortium (ISC) BIND 9↗2022-05-02
▶
CVEList
CVE-2009-0265: Internet Systems Consortium (ISC) BIND 9↗2009-01-26
▶

📋Vendor Advisories

2
Debian
CVE-2009-0265: bind9 - Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check...↗2009
▶
Red Hat
CVE-2009-0265: Internet Systems Consortium (ISC) BIND 9↗
▶
CVE-2009-0265 — Unchecked Return Value in ISC Bind | cvebase