CVE-2010-0382

2010-01-2222:00:00

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

241

isc bind

cve-2010-0382

remote attack

bug 20819

out-of-bailiwick data

secure response

vulnerability

6.9 Medium

AI Score

Confidence

High

7.6 High

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

0.04 Low

EPSS

Percentile

91.9%

JSON

ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.

CPENameOperatorVersion
isc:bindisc bindeq9.10.0
isc:bindisc bindeq9.10.2
isc:bindisc bindeq9.6.1
isc:bindisc bindeq9.2.0
isc:bindisc bindeq9.1.1
isc:bindisc bindeq9.3.1
isc:bindisc bindeq9.4.3
isc:bindisc bindeq9.2.3
isc:bindisc bindeq9.1.3
isc:bindisc bindeq9.10.1

CPE	Name	Operator	Version
isc:bind	isc bind	eq	9.10.0
isc:bind	isc bind	eq	9.10.2
isc:bind	isc bind	eq	9.6.1
isc:bind	isc bind	eq	9.2.0
isc:bind	isc bind	eq	9.1.1
isc:bind	isc bind	eq	9.3.1
isc:bind	isc bind	eq	9.4.3
isc:bind	isc bind	eq	9.2.3
isc:bind	isc bind	eq	9.1.3
isc:bind	isc bind	eq	9.10.1