CVE-2010-3615

ISC BIND 9.7.2-P2 - Unauthenticated Private DNS Record Exposure via Missing ACL Check

Title source: llm

Description

named in ISC BIND 9.7.2-P2 does not check all intended locations for allow-query ACLs, which might allow remote attackers to make successful requests for private DNS records via the standard DNS query mechanism.

References (11)

Core 11

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/69568

Various Sources x_refsource_confirm

http://www.isc.org/announcement/guidance-regarding-dec-1st-2010-security-advisories

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1024817

Vendor Advisory x_refsource_confirm

http://www.isc.org/software/bind/advisories/cve-2010-3615

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/42458

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/45134

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2010/3102

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/42671

US Government Resource third-party-advisory x_refsource_cert-vn

http://www.kb.cert.org/vuls/id/510208

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051963.html

Vendor Advisory vendor-advisory x_refsource_slackware

http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.622190

Scores

EPSS 0.0529

EPSS Percentile 90.1%

Details

CWE

CWE-264

Status published

Products (1)

isc/bind 9.7.2 p2

Published Dec 06, 2010

Tracked Since Feb 18, 2026