CVE-2010-0290: Medium severity ISC BIND vulnerability
The original fix for CVE-2009-4022 was found to be incomplete. BIND was incorrectly caching certain responses without performing proper DNSSEC validation. CNAME and DNAME records could be cached, without proper DNSSEC validation, when received from processing recursive client queries that requested DNSSEC records but indicated that checking should be disabled. A remote attacker could use this flaw to bypass the DNSSEC validation check and perform a cache poisoning attack if the target BIND server was receiving such client queries.
Other sources
Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains (1) CNAME or (2) DNAME records, which do not have the intended validation before caching, aka Bug 20737. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-4022.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0290?
The severity of CVE-2010-0290 is considered high due to improper caching of DNS responses without DNSSEC validation.
How do I fix CVE-2010-0290?
To fix CVE-2010-0290, upgrade your BIND software to a version that includes the proper patches for this vulnerability.
Which versions are affected by CVE-2010-0290?
CVE-2010-0290 affects multiple versions of BIND 9, including from 9.0 to 9.10.x.
What is the impact of CVE-2010-0290?
The impact of CVE-2010-0290 includes potential cache poisoning and manipulation of DNS responses.
Is a workaround available for CVE-2010-0290?
A temporary workaround for CVE-2010-0290 might involve disabling DNSSEC or adjusting caching settings, but upgrading to a patched version is the recommended solution.