National Cyber-Alert System

Vulnerability Summary for CVE-2009-0025

Overview

BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA09-133A

Name: TA09-133A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA09-133A.html

External Source: FEDORA

Name: FEDORA-2009-0350

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00393.html

External Source: CONFIRM

Name: https://www.isc.org/node/373

Hyperlink:https://www.isc.org/node/373

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-2938

Hyperlink:https://issues.rpath.com/browse/RPL-2938

External Source: VUPEN

Name: ADV-2009-1297

Hyperlink:http://www.vupen.com/english/advisories/2009/1297

External Source: VUPEN

Name: ADV-2009-0904

Hyperlink:http://www.vupen.com/english/advisories/2009/0904

External Source: CONFIRM

Name: http://www.vmware.com/security/advisories/VMSA-2009-0004.html

Hyperlink:http://www.vmware.com/security/advisories/VMSA-2009-0004.html

External Source: BUGTRAQ

Name: 20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/502322/100/0/threaded

External Source: BUGTRAQ

Name: 20090120 rPSA-2009-0009-1 bind bind-utils

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/500207/100/0/threaded

External Source: CONFIRM

Name: http://www.openbsd.org/errata44.html#008_bind

Hyperlink:http://www.openbsd.org/errata44.html#008_bind

External Source: MISC

Name: http://www.ocert.org/advisories/ocert-2008-016.html

Hyperlink:http://www.ocert.org/advisories/ocert-2008-016.html

External Source: VUPEN

Name: ADV-2009-0366

Hyperlink:http://www.frsirt.com/english/advisories/2009/0366

External Source: VUPEN

Name: ADV-2009-0043

Hyperlink:http://www.frsirt.com/english/advisories/2009/0043

External Source: CONFIRM

Name: http://wiki.rpath.com/Advisories:rPSA-2009-0009

Hyperlink:http://wiki.rpath.com/Advisories:rPSA-2009-0009

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2009-045.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2009-045.htm

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3549

Hyperlink:http://support.apple.com/kb/HT3549

External Source: SUNALERT

Name: 250846

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-250846-1

External Source: SLACKWARE

Name: SSA:2009-014-02

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.540362

External Source: FREEBSD

Name: FreeBSD-SA-09:04

Hyperlink:http://security.freebsd.org/advisories/FreeBSD-SA-09:04.bind.asc

External Source: SECUNIA

Name: 35074

Hyperlink:http://secunia.com/advisories/35074

External Source: SECUNIA

Name: 33882

Hyperlink:http://secunia.com/advisories/33882

External Source: SECUNIA

Name: 33683

Hyperlink:http://secunia.com/advisories/33683

External Source: SECUNIA

Name: 33559

Hyperlink:http://secunia.com/advisories/33559

External Source: SECUNIA

Name: 33551

Hyperlink:http://secunia.com/advisories/33551

External Source: SECUNIA

Name: 33546

Hyperlink:http://secunia.com/advisories/33546

External Source: SECUNIA

Name: 33494

Hyperlink:http://secunia.com/advisories/33494

External Source: APPLE

Name: APPLE-SA-2009-05-12

Hyperlink:http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

External Source: MISC

Name: http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33

Hyperlink:http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33