CVE-2013-2266

2013-03-2600:00:00

ubuntu.com

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.943 High

EPSS

Percentile

99.2%

JSON

libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2,
9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows
remote attackers to cause a denial of service (memory consumption) via a
crafted regular expression, as demonstrated by a memory-exhaustion attack
against a machine running a named process.

Bugs

<https://bugs.launchpad.net/bugs/1161794>

Notes

Author	Note
seth-arnold	No patch will be provided for 9.7. The suggested workaround is re-compile without regex support.

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchbind9< 1:9.7.0.dfsg.P1-1ubuntu0.9UNKNOWN
ubuntu11.10noarchbind9< 1:9.7.3.dfsg-1ubuntu4.6UNKNOWN
ubuntu12.04noarchbind9< 1:9.8.1.dfsg.P1-4ubuntu0.6UNKNOWN
ubuntu12.10noarchbind9< 1:9.8.1.dfsg.P1-4.2ubuntu3.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	bind9	< 1:9.7.0.dfsg.P1-1ubuntu0.9	UNKNOWN
ubuntu	11.10	noarch	bind9	< 1:9.7.3.dfsg-1ubuntu4.6	UNKNOWN
ubuntu	12.04	noarch	bind9	< 1:9.8.1.dfsg.P1-4ubuntu0.6	UNKNOWN
ubuntu	12.10	noarch	bind9	< 1:9.8.1.dfsg.P1-4.2ubuntu3.2	UNKNOWN