US-CERT
Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information
 

 View Notes By
Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric

 Other Documents
Technical Alerts

Technical Bulletins

Alerts

Security Tips

ISC Information for VU#325431

Date Notified01/02/2001
Date Modified05/01/2002 03:11:26 PM
Status SummaryVulnerable

Vendor Statement

Name: "infoleak"
Versions: 4.8, 4.8.3, 4.9.3, 4.9.4, 4.9.5, 4.9.5-P1, 4.9.6, 4.9.7,
8.1, 8.1.1, 8.2, 8.2-P1, 8.2.1, 8.2.2, 8.2.2-P1, 8.2.2-P2,
8.2.2-P3, 8.2.2-P4, 8.2.2-P5, 8.2.2-P6, 8.2.2-P7,
possibly earlier version of BIND 4.9.x and BIND 4.9.
Severity: MODERATE
Exploitable: Remotely
Type: Information leak

Description:

It is possible to construct a inverse query that allows the stack to
be read remotely exposing environment variables.

Workarounds:

None.

Active Exploits.

Exploits of this bug exist.

Solution:

Upgrade to BIND 9, BIND 8.2.3 or BIND 4.9.8

Credits:

We wish to thank Claudio Musmarra <a9605121@unet.univie.ac.at>
for bring this to our attention.

US-CERT Addendum

The ISC has posted this information on their web site at:
The source code for ISC BIND can be downloaded from:

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

Produced 2008 by US-CERT, a government organization
Disclaimers and copyright information