Description
ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta does not properly validate DNSSEC (1) NSEC and (2) NSEC3 records, which allows remote attackers to add the Authenticated Data (AD) flag to a forged NXDOMAIN response for an existing domain.
Published: 2010-01-22
Score: 4.3 Medium
EPSS: 2.8% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-2054-1 New bind9 packages fix cache poisoning
Debian DSA Debian DSA DSA-2054-2 New bind9 packages fix cache poisoning
EUVD EUVD EUVD-2010-0129 ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta does not properly validate DNSSEC (1) NSEC and (2) NSEC3 records, which allows remote attackers to add the Authenticated Data (AD) flag to a forged NXDOMAIN response for an existing domain.
Ubuntu USN Ubuntu USN USN-888-1 Bind vulnerabilities
References
Link Providers
ftp://ftp.sco.com/pub/unixware7/714/security/p535243_uw7/p535243b.txt cve-icon cve-icon
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034196.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034202.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html cve-icon cve-icon
http://marc.info/?l=bugtraq&m=127195582210247&w=2 cve-icon cve-icon
http://secunia.com/advisories/38169 cve-icon cve-icon
http://secunia.com/advisories/38219 cve-icon cve-icon
http://secunia.com/advisories/38240 cve-icon cve-icon
http://secunia.com/advisories/39334 cve-icon cve-icon
http://secunia.com/advisories/39582 cve-icon cve-icon
http://secunia.com/advisories/40086 cve-icon cve-icon
http://securitytracker.com/id?1023474 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021798.1-1 cve-icon cve-icon
http://support.apple.com/kb/HT5002 cve-icon cve-icon
http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0018 cve-icon cve-icon
http://www.debian.org/security/2010/dsa-2054 cve-icon cve-icon
http://www.kb.cert.org/vuls/id/360341 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2010:021 cve-icon cve-icon
http://www.osvdb.org/61853 cve-icon cve-icon
http://www.securityfocus.com/bid/37865 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-888-1 cve-icon cve-icon
http://www.vupen.com/english/advisories/2010/0176 cve-icon cve-icon
http://www.vupen.com/english/advisories/2010/0622 cve-icon cve-icon
http://www.vupen.com/english/advisories/2010/0981 cve-icon cve-icon
http://www.vupen.com/english/advisories/2010/1352 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=554851 cve-icon cve-icon
https://exchange.xforce.ibmcloud.com/vulnerabilities/55753 cve-icon cve-icon
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2010-0097 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12205 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7212 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7430 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9357 cve-icon cve-icon
https://rhn.redhat.com/errata/RHSA-2010-0062.html cve-icon cve-icon
https://rhn.redhat.com/errata/RHSA-2010-0095.html cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2010-0097 cve-icon
https://www.isc.org/advisories/CVE-2010-0097 cve-icon cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published:

Updated: 2024-08-07T00:37:53.920Z

Reserved: 2009-12-30T00:00:00.000Z

Link: CVE-2010-0097

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2010-01-22T22:00:00.397

Modified: 2026-04-29T01:13:23.040

Link: CVE-2010-0097

cve-icon Redhat

Severity : Moderate

Publid Date: 2010-01-19T00:00:00Z

Links: CVE-2010-0097 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses