National Cyber-Alert System

Vulnerability Summary for CVE-2002-1221

Overview

BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#581682

Name: VU#581682

Hyperlink:http://www.kb.cert.org/vuls/id/581682

CERT/CC Advisory: CA-2002-31

Name: CA-2002-31

Hyperlink:http://www.cert.org/advisories/CA-2002-31.html

External Source: CONFIRM

Name: http://www.isc.org/products/BIND/bind-security.html

Type: Advisory; Patch Information

Hyperlink:http://www.isc.org/products/BIND/bind-security.html

External Source: BUGTRAQ

Name: 20021112 [Fwd: Notice of serious vulnerabilities in ISC BIND 4 & 8]

Type: Advisory; Patch Information

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=103713117612842&w=2

External Source: ISS

Name: 20021112 Multiple Remote Vulnerabilities in BIND4 and BIND8

Type: Advisory; Patch Information

Hyperlink:http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21469

External Source: XF

Name: bind-null-dereference-dos(10333)

Hyperlink:http://xforce.iss.net/xforce/xfdb/10333

External Source: BID

Name: 6159

Hyperlink:http://www.securityfocus.com/bid/6159

External Source: MANDRAKE

Name: MDKSA-2002:077

Hyperlink:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-077.php

External Source: DEBIAN

Name: DSA-196

Hyperlink:http://www.debian.org/security/2002/dsa-196

External Source: CIAC

Name: N-013

Hyperlink:http://www.ciac.org/ciac/bulletins/n-013.shtml

External Source: BUGTRAQ

Name: 20021115 [OpenPKG-SA-2002.011] OpenPKG Security Advisory (bind, bind8)

Hyperlink:http://online.securityfocus.com/archive/1/300019

External Source: COMPAQ

Name: SSRT2408

Hyperlink:http://online.securityfocus.com/advisories/4999

External Source: BUGTRAQ

Name: 20021118 TSLSA-2002-0076 - bind

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=103763574715133&w=2

External Source: APPLE

Name: 2002-11-21

Hyperlink:http://lists.apple.com/archives/Security-announce/2002/Nov/msg00000.html

External Source: CONECTIVA

Name: CLA-2002:546

Hyperlink:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000546

US Government Resource: oval:org.mitre.oval:def:2094

Name: oval:org.mitre.oval:def:2094

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2094