full-disclosure - Re: On the impact of CVE-2013-2266 (BIND9)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <51549B7F.5060708@isc.org>
Date: Thu, 28 Mar 2013 15:35:27 -0400
From: Jeff Wright <jwright@....org>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: On the impact of CVE-2013-2266 (BIND9)

In response to comments on this list from Daniel Franke, describing a
possible exploitation scenario for the CVE-2013-2266 vulnerability, ISC
would like to point out that the vector identified by Mr. Franke is not
the only one possible, and that operators of *ANY* recursive *OR*
authoritative nameservers running an unpatched installation of an
affected version of BIND should consider themselves vulnerable to this
security issue.

We wish, however, to express agreement with the main point of Mr.
Franke's comment, which is that the required complexity of the exploit
for this vulnerability is not high, and immediate action is recommended
to ensure your nameservers are not at risk.

Jeff Wright

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/