CVE-2010-0097 — Improper Input Validation in Bind

CWE-20 — Improper Input Validation8 documents8 sources
Severity
4.3MEDIUMNVD
EPSS
2.8%
top 13.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ISC Bind9ISC Bind
Timeline
PublishedJan 22
Latest updateMay 3

Description

ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta does not properly validate DNSSEC (1) NSEC and (2) NSEC3 records, which allows remote attackers to add the Authenticated Data (AD) flag to a forged NXDOMAIN response for an existing domain.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶Debianisc/bind9< 1:9.7.0.dfsg-1+3
▶NVDisc/bind40 versions+39

🔴Vulnerability Details

3
GHSA
GHSA-jh4w-mm2p-mw7c: ISC BIND 9↗2022-05-03
▶
CVEList
CVE-2010-0097: ISC BIND 9↗2010-01-22
▶
OSV
CVE-2010-0097: ISC BIND 9↗2010-01-22
▶

📋Vendor Advisories

3
Ubuntu
Bind vulnerabilities↗2010-01-20
▶
Red Hat
BIND DNSSEC NSEC/NSEC3 validation code could cause bogus NXDOMAIN responses↗2010-01-19
▶
Debian
CVE-2010-0097: bind9 - ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 befo...↗2010
▶

💬Community

1
Bugzilla
CVE-2010-0097 BIND DNSSEC NSEC/NSEC3 validation code could cause bogus NXDOMAIN responses↗2010-01-12
▶
CVE-2010-0097 — Improper Input Validation in ISC Bind | cvebase