US-CERT
Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information
 

 View Notes By
Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric

 Other Documents
Technical Alerts

Technical Bulletins

Alerts

Security Tips

ISC Information for VU#572183

Date Notified01/02/2001
Date Modified05/01/2002 03:11:27 PM
Status SummaryVulnerable

Vendor Statement

Name: "complain bug"
Versions: 4.9.3, 4.9.4, 4.9.5, 4.9.5-P1, 4.9.6, 4.9.7, possibly earlier
version of BIND 4.9.x and BIND 4.9.
Severity: SERIOUS
Exploitable: Remotely
Type: Stack corruption, possible remote access.

Description:

It is possible to overflow the buffer used by sprintf in
nslookupComplain().

Workarounds:

None.

Active Exploits:

Exploits for this bug exist.

Solution:

Upgrade to BIND 9, BIND 8 or BIND 4.9.8, in preferred
solution order. BIND 4.9.x should be considered to be dead
code. Only security fixes will be applied BIND 4.9.x.

Credits:

Discovery and initial documentation of this vulnerability
was conducted by Anthony Osborne and John McDonald of the
COVERT Labs at PGP Security.

US-CERT Addendum

The ISC has posted this information on their web site at:
The source code for ISC BIND can be downloaded from:

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

Produced 2008 by US-CERT, a government organization
Disclaimers and copyright information