CVE-2023-50387

Certain DNSSEC aspects of the DNS protocol in RFC 4033, 4034, 4035, 6840, and related RFCs allow remote attackers to cause a denial of service CPU consumption via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG...

CVE-2023-50387

Certain DNSSEC aspects of the DNS protocol in RFC 4033, 4034, 4035, 6840, and related RFCs allow remote attackers to cause a denial of service CPU consumption via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG...

length OF THE BYTES ARRAY IS NOT CHECKED BEFORE SUBSTRING IS EXTRACTED FROM IT, WHICH COULD LEAD TO SUBSTRING OF bytes(0)

Lines of code Vulnerability details Impact In RRUtils.readDNSKEY function, if the length == 4 then the self.publicKey will be an empty bytes array. No check is performed to validata the length variable. This will return the public key of the DNSKEY as an empty bytes array. Check should be perform...

verifySignatureWithKey - RRSIG RR's Signer's Name is never checked if it matches owner name

Lines of code Vulnerability details Impact According to RFC 4035 and as mentioned in the comments in function "verifySignatureWithKey" , the Signer's name should also be checked if it matches the owner name. If the Signer's Name field of an RRSIG record does not match the owner name of a DNSKEY...

Huawei EulerOS: Security Advisory for unbound (EulerOS-SA-2023-1156)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-3204

A vulnerability named 'Non-Responsive Delegation Attack' NRDelegation Attack has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for...

CVE-2017-15090

An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of...

bind security update

32:9.8.2-0.68.rc1.0.3.8 - Backport fix for CVE-2018-5741 Orabug: 33496185 32:9.8.2-0.68.rc1.0.2.8 - Backport possible assertion failure on DNAME processing CVE-2021-25215 32:9.8.2-0.68.rc1.0.1.8 - Backport the fix for buffer overflow CVE-2020-8625 Orabug: 32588749 32:9.8.2-0.68.rc1.8 - Fix...

OracleVM 3.3 / 3.4 : bind (OVMSA-2018-0252)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2018-5740 - Fix CVE-2017-3145 - Change EDNS flags only after successful query 1416035 - Fix crash in ldap driver at bind-sdb stop 1426626 - Fix CVE-2017-3142, CVE-2017-3143 - Update root serve...

CVE-2017-15090

An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of...

CVE-2017-15090: Improper Verification of Cryptographic Signature

An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of...

Fedora 26 : knot / knot-resolver (2017-31519ecf40)

"Major updates for Knot DNS and Knot Resolver: Knot Resolver 1.5.0 2017-11-02 ================================ Bugfixes -------- - fix loading modules on Darwin Improvements ------------ - new module tasignalquery supporting Signaling Trust Anchor Knowledge using Keytag Query RFC 8145 section 5...

OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0100)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix DNSKEY that encountered a CNAME 1447869, ISC change 3391 - Fix CVE-2017-3136 ISC change 4575 - Fix CVE-2017-3137 ISC change 4578 - Fix and test caching CNAME before DNAME ISC change 4558 - Fix...

bind security update

32:9.8.2-0.62.rc1.2 - Fix DNSKEY that encountered a CNAME 1447869, ISC change 3391...

Skyliner: DNSSEC misconfiguration

First of all I will start with some theory. DNS is a system to translate a domain name to an ip address. Normally a computer automatically trust a DNS server and connects to the IP provided by the DNS server. This is prone to security issues because a malicious wifi network, an attacker on your...

AIX 6.1 TL 4 : bind9 (IV01118)

The security status of an NS RRset is not properly determined during a DNSKEY algorithm rollover which can allow a remote attacker to cause a denial of service. Signed negative responses and corresponding RRSIG records in the cache are not properly handled which can allow a remote attacker to cau...

AIX 5.3 TL 12 : bind9 (IZ99391)

The security status of an NS RRset is not properly determined during a DNSKEY algorithm rollover which can allow a remote attacker to cause a denial of service. Signed negative responses and corresponding RRSIG records in the cache are not properly handled which can allow a remote attacker to cau...

[SECURITY] [DSA-2130-1] New BIND packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-2130-1 [email protected] http://www.debian.org/security/ Florian Weimer December 10, 2010 http://www.debian.org/security/faq -...

DEBIAN-CVE-2010-3614

named in ISC BIND 9.x before 9.6.2-P3, 9.7.x before 9.7.2-P3, 9.4-ESV before 9.4-ESV-R4, and 9.6-ESV before 9.6-ESV-R3 does not properly determine the security status of an NS RRset during a DNSKEY algorithm rollover, which might allow remote attackers to cause a denial of service DNSSEC validati...

CVE-2010-3614

named in ISC BIND 9.x before 9.6.2-P3, 9.7.x before 9.7.2-P3, 9.4-ESV before 9.4-ESV-R4, and 9.6-ESV before 9.6-ESV-R3 does not properly determine the security status of an NS RRset during a DNSKEY algorithm rollover, which might allow remote attackers to cause a denial of service DNSSEC validati...