BIND 8 Negative Cache Poisoning May Cause Denial of Service Conditions
|
|
SecurityTracker Alert ID: 1008313
|
|
CVE Reference: CAN-2003-0914
(Links to External Site)
|
Date: Nov 27 2003
|
Impact: Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 8.4.2 and prior versions
|
Description: A vulnerability was reported in BIND 8. A remote user can introduce invalid DNS records to cause denial of service conditions.
It is reported that a remote user can conduct a cache poisoning attack by causing the target server to retain invalid negative responses.
A temporary denial of service may occur until the invalid record expires from the cache.
No further details were provided.
|
Impact: A remote user can cause denial of service conditions.
|
Solution: The vendor has released a fixed version (8.4.3), available at:
ftp://ftp.isc.org/isc/bind/src/8.4.3
|
Vendor URL: isc.org/products/BIND/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 26 Nov 2003 20:00:43 -0500
Subject: BIND security update
|
A vulnerability was reported in BIND. A remote user can conduct a cache poisoning attack
by causing the target server to retain invalid negative responses. A temporary denial of
service may occur until the invalid record expires from the cache.
CVE: CAN-2003-0914
|
|
