Upstream information
Description
ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having important severity.
National Vulnerability Database | |
---|---|
Base Score | 7.6 |
Vector | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Access Vector | Network |
Access Complexity | High |
Authentication | None |
Confidentiality Impact | Complete |
Integrity Impact | Complete |
Availability Impact | Complete |
Note from the SUSE Security Team
This fix was necessary due to an incomplete earlier fix. We did not release the earlier fix, only the complete one. So no product is affected by this issue. SUSE Bugzilla entries: 570912 [RESOLVED / FIXED], 644911 [RESOLVED / DUPLICATE] No SUSE Security Announcements cross referenced.SUSE Timeline for this CVE
CVE page created: Fri Jun 28 03:33:21 2013CVE page last modified: Sat Jul 1 19:16:04 2023