ISC Information for VU#325431
Queries to ISC BIND servers may disclose environment variables
- Vendor Information Help Date Notified: 02 Jan 2001
- Statement Date:
- Date Updated: 04 Apr 2001
Versions: 4.8, 4.8.3, 4.9.3, 4.9.4, 4.9.5, 4.9.5-P1, 4.9.6, 4.9.7,
8.1, 8.1.1, 8.2, 8.2-P1, 8.2.1, 8.2.2, 8.2.2-P1, 8.2.2-P2,
8.2.2-P3, 8.2.2-P4, 8.2.2-P5, 8.2.2-P6, 8.2.2-P7,
possibly earlier version of BIND 4.9.x and BIND 4.9.
Type: Information leak
It is possible to construct a inverse query that allows the stack to
be read remotely exposing environment variables.
Exploits of this bug exist.
Upgrade to BIND 9, BIND 8.2.3 or BIND 4.9.8
We wish to thank Claudio Musmarra <firstname.lastname@example.org>
for bring this to our attention.
The vendor has not provided us with any further information regarding this vulnerability.
The ISC has posted this information on their web site at:
The source code for ISC BIND can be downloaded from: