|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
|
ISC Information for VU#572183
| Date Notified | 01/02/2001 |
| Date Modified | 05/01/2002 03:11:27 PM |
| Status Summary | Vulnerable |
Vendor StatementName: "complain bug"
Versions: 4.9.3, 4.9.4, 4.9.5, 4.9.5-P1, 4.9.6, 4.9.7, possibly earlier
version of BIND 4.9.x and BIND 4.9.
Severity: SERIOUS
Exploitable: Remotely
Type: Stack corruption, possible remote access.
Description:
It is possible to overflow the buffer used by sprintf in
nslookupComplain().
Workarounds:
None.
Active Exploits:
Exploits for this bug exist.
Solution:
Upgrade to BIND 9, BIND 8 or BIND 4.9.8, in preferred
solution order. BIND 4.9.x should be considered to be dead
code. Only security fixes will be applied BIND 4.9.x.
Credits:
Discovery and initial documentation of this vulnerability
was conducted by Anthony Osborne and John McDonald of the
COVERT Labs at PGP Security.
US-CERT AddendumThe ISC has posted this information on their web site at:
The source code for ISC BIND can be downloaded from:
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
 |
