CVE-2013-6230

2013-11-0804:47:00

CWE-264

[email protected]

web.nvd.nist.gov

241

cve

2013

6230

winsock

wsaioctl

api

microsoft

windows

server

2008

isc

bind

9.6-esv

9.8

9.9

netmask

remote attackers

ip address restrictions

nvd

6.9 Medium

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

74.9%

JSON

The Winsock WSAIoctl API in Microsoft Windows Server 2008, as used in ISC BIND 9.6-ESV before 9.6-ESV-R10-P1, 9.8 before 9.8.6-P1, 9.9 before 9.9.4-P1, 9.9.3-S1, 9.9.4-S1, and other products, does not properly support the SIO_GET_INTERFACE_LIST command for netmask 255.255.255.255, which allows remote attackers to bypass intended IP address restrictions by leveraging misinterpretation of this netmask as a 0.0.0.0 netmask.

CPENameOperatorVersion
isc:bindisc bindeq9.9.3
isc:bindisc bindeq9.8.4
isc:bindisc bindeq9.8.1
isc:bindisc bindeq9.8.3
isc:bindisc bindeq9.9.0
isc:bindisc bindeq9.8.5
isc:bindisc bindeq9.8.2
isc:bindisc bindeq9.8.0
isc:bindisc bindeq9.9.4
isc:bindisc bindeq9.9.1

CPE	Name	Operator	Version
isc:bind	isc bind	eq	9.9.3
isc:bind	isc bind	eq	9.8.4
isc:bind	isc bind	eq	9.8.1
isc:bind	isc bind	eq	9.8.3
isc:bind	isc bind	eq	9.9.0
isc:bind	isc bind	eq	9.8.5
isc:bind	isc bind	eq	9.8.2
isc:bind	isc bind	eq	9.8.0
isc:bind	isc bind	eq	9.9.4
isc:bind	isc bind	eq	9.9.1