CVE-2012-3868
published 2012-07-25CVE-2012-3868: Race condition in the ns_client structure management in ISC BIND 9.9.x before 9.9.1-P2 allows remote attackers to cause a denial of service (memory consumption…
PriorityP419medium4.3CVSS 2.0
AVNACMAuNCNINAP
EPSS
2.72%
85.1th percentile
Race condition in the ns_client structure management in ISC BIND 9.9.x before 9.9.1-P2 allows remote attackers to cause a denial of service (memory consumption or process exit) via a large volume of TCP queries.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | bind9 | — | — |
| debian | isc-dhcp | — | — |
| isc | bind | — | — |
| isc | bind | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
vendor_debian4.3LOW
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v87w-rgf8-76jc: Race condition in the ns_client structure management in ISC BIND 9
ghsa_unreviewed·2022-05-17
CVE-2012-3868 [MEDIUM] CWE-362 GHSA-v87w-rgf8-76jc: Race condition in the ns_client structure management in ISC BIND 9
Race condition in the ns_client structure management in ISC BIND 9.9.x before 9.9.1-P2 allows remote attackers to cause a denial of service (memory consumption or process exit) via a large volume of TCP queries.
Red Hat
bind: high TCP query load can trigger memory leak
vendor_redhat·2012-07-24·CVSS 4.3
CVE-2012-3868 [MEDIUM] CWE-401 bind: high TCP query load can trigger memory leak
bind: high TCP query load can trigger memory leak
Race condition in the ns_client structure management in ISC BIND 9.9.x before 9.9.1-P2 allows remote attackers to cause a denial of service (memory consumption or process exit) via a large volume of TCP queries.
Statement: Not vulnerable. This issue did not affect the versions of bind or bind97 as shipped with Red Hat Enterprise Linux 4, 5, and 6.
Package: bind (Red Hat Enterprise Linux 5) - Not affected
Package: bind97 (Red Hat Enterprise Linux 5) - Not affected
Package: bind (Red Hat Enterprise Linux 6) - Not affected
Debian
CVE-2012-3868: bind9 - Race condition in the ns_client structure management in ISC BIND 9.9.x before 9....
vendor_debian·2012·CVSS 4.3
CVE-2012-3868 [MEDIUM] CVE-2012-3868: bind9 - Race condition in the ns_client structure management in ISC BIND 9.9.x before 9....
Race condition in the ns_client structure management in ISC BIND 9.9.x before 9.9.1-P2 allows remote attackers to cause a denial of service (memory consumption or process exit) via a large volume of TCP queries.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-3868 bind: high TCP query load can trigger memory leak
bugzilla·2012-07-24·CVSS 4.3
CVE-2012-3868 [MEDIUM] CVE-2012-3868 bind: high TCP query load can trigger memory leak
CVE-2012-3868 bind: high TCP query load can trigger memory leak
Upstream has released BIND 9.9.1-P2 to correct the following flaw:
BIND 9 tracks incoming queries using a structure called "ns_client". When a query has been answered and the ns_client structure is no longer needed, it is stored on a queue of inactive ns_clients. When a new ns_client is needed to service a new query, the queue is checked to see if any inactive ns_clients are available before a new one is allocated; this speeds up the system by avoiding unnecessary memory allocations and de-allocations. However, when the queue is empty, and one thread inserts an ns_client into it while another thread attempts to remove it, a race bug could cause the ns_client to be lost; since the queue would appear empty in that case, a new
Bugzilla
CVE-2012-3868 bind: high TCP query load can trigger memory leak [fedora-17]
bugzilla·2012-07-24·CVSS 4.3
CVE-2012-3868 [MEDIUM] CVE-2012-3868 bind: high TCP query load can trigger memory leak [fedora-17]
CVE-2012-3868 bind: high TCP query load can trigger memory leak [fedora-17]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security
2012-07-25
Published