First published: Wed Jan 20 2010(Updated: )
The original fix for <a href="https://access.redhat.com/security/cve/CVE-2009-4022">CVE-2009-4022</a> was found to be incomplete. BIND was incorrectly caching certain responses without performing proper DNSSEC validation. CNAME and DNAME records could be cached, without proper DNSSEC validation, when received from processing recursive client queries that requested DNSSEC records but indicated that checking should be disabled. A remote attacker could use this flaw to bypass the DNSSEC validation check and perform a cache poisoning attack if the target BIND server was receiving such client queries.
Credit: secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
BIND 9 | =9.0 | |
BIND 9 | =9.0.0-rc1 | |
BIND 9 | =9.0.0-rc2 | |
BIND 9 | =9.0.0-rc3 | |
BIND 9 | =9.0.0-rc4 | |
BIND 9 | =9.0.0-rc5 | |
BIND 9 | =9.0.0-rc6 | |
BIND 9 | =9.0.1 | |
BIND 9 | =9.0.1-rc1 | |
BIND 9 | =9.0.1-rc2 | |
BIND 9 | =9.1 | |
BIND 9 | =9.1.0-rc1 | |
BIND 9 | =9.1.1 | |
BIND 9 | =9.1.1-rc1 | |
BIND 9 | =9.1.1-rc2 | |
BIND 9 | =9.1.1-rc3 | |
BIND 9 | =9.1.1-rc4 | |
BIND 9 | =9.1.1-rc5 | |
BIND 9 | =9.1.1-rc6 | |
BIND 9 | =9.1.1-rc7 | |
BIND 9 | =9.1.2 | |
BIND 9 | =9.1.2-rc1 | |
BIND 9 | =9.1.3 | |
BIND 9 | =9.1.3-rc1 | |
BIND 9 | =9.1.3-rc2 | |
BIND 9 | =9.1.3-rc3 | |
BIND 9 | =9.2 | |
BIND 9 | =9.2.0 | |
BIND 9 | =9.2.0-a1 | |
BIND 9 | =9.2.0-a2 | |
BIND 9 | =9.2.0-a3 | |
BIND 9 | =9.2.0-b1 | |
BIND 9 | =9.2.0-b2 | |
BIND 9 | =9.2.0-rc1 | |
BIND 9 | =9.2.0-rc10 | |
BIND 9 | =9.2.0-rc2 | |
BIND 9 | =9.2.0-rc3 | |
BIND 9 | =9.2.0-rc4 | |
BIND 9 | =9.2.0-rc5 | |
BIND 9 | =9.2.0-rc6 | |
BIND 9 | =9.2.0-rc7 | |
BIND 9 | =9.2.0-rc8 | |
BIND 9 | =9.2.0-rc9 | |
BIND 9 | =9.2.1 | |
BIND 9 | =9.2.1-rc1 | |
BIND 9 | =9.2.1-rc2 | |
BIND 9 | =9.2.2 | |
BIND 9 | =9.2.2-p2 | |
BIND 9 | =9.2.2-p3 | |
BIND 9 | =9.2.2-rc1 | |
BIND 9 | =9.2.3 | |
BIND 9 | =9.2.3-rc1 | |
BIND 9 | =9.2.3-rc2 | |
BIND 9 | =9.2.3-rc3 | |
BIND 9 | =9.2.3-rc4 | |
BIND 9 | =9.2.4 | |
BIND 9 | =9.2.4-rc2 | |
BIND 9 | =9.2.4-rc3 | |
BIND 9 | =9.2.4-rc4 | |
BIND 9 | =9.2.4-rc5 | |
BIND 9 | =9.2.4-rc6 | |
BIND 9 | =9.2.4-rc7 | |
BIND 9 | =9.2.4-rc8 | |
BIND 9 | =9.2.5 | |
BIND 9 | =9.2.5-b2 | |
BIND 9 | =9.2.5-rc1 | |
BIND 9 | =9.2.6 | |
BIND 9 | =9.2.6-rc1 | |
BIND 9 | =9.2.7 | |
BIND 9 | =9.2.7-rc1 | |
BIND 9 | =9.2.7-rc2 | |
BIND 9 | =9.2.7-rc3 | |
BIND 9 | =9.2.8 | |
BIND 9 | =9.2.9 | |
BIND 9 | =9.2.9-rc1 | |
BIND 9 | =9.3 | |
BIND 9 | =9.3.0 | |
BIND 9 | =9.3.0-b2 | |
BIND 9 | =9.3.0-b3 | |
BIND 9 | =9.3.0-b4 | |
BIND 9 | =9.3.0-rc1 | |
BIND 9 | =9.3.0-rc2 | |
BIND 9 | =9.3.0-rc3 | |
BIND 9 | =9.3.0-rc4 | |
BIND 9 | =9.3.1 | |
BIND 9 | =9.3.1-b2 | |
BIND 9 | =9.3.1-rc1 | |
BIND 9 | =9.3.2 | |
BIND 9 | =9.3.2-rc1 | |
BIND 9 | =9.3.3 | |
BIND 9 | =9.3.3-rc1 | |
BIND 9 | =9.3.3-rc2 | |
BIND 9 | =9.3.3-rc3 | |
BIND 9 | =9.3.4 | |
BIND 9 | =9.3.5 | |
BIND 9 | =9.3.5-rc1 | |
BIND 9 | =9.3.5-rc2 | |
BIND 9 | =9.3.6 | |
BIND 9 | =9.3.6-rc1 | |
BIND 9 | =9.4 | |
BIND 9 | =9.4.0 | |
BIND 9 | =9.4.0-a1 | |
BIND 9 | =9.4.0-a2 | |
BIND 9 | =9.4.0-a3 | |
BIND 9 | =9.4.0-a4 | |
BIND 9 | =9.4.0-a5 | |
BIND 9 | =9.4.0-a6 | |
BIND 9 | =9.4.0-b1 | |
BIND 9 | =9.4.0-b2 | |
BIND 9 | =9.4.0-b3 | |
BIND 9 | =9.4.0-b4 | |
BIND 9 | =9.4.0-rc1 | |
BIND 9 | =9.4.0-rc2 | |
BIND 9 | =9.4.1 | |
BIND 9 | =9.4.2 | |
BIND 9 | =9.4.2-rc1 | |
BIND 9 | =9.4.2-rc2 | |
BIND 9 | =9.4.3 | |
BIND 9 | =9.4.3-b1 | |
BIND 9 | =9.4.3-b2 | |
BIND 9 | =9.4.3-b3 | |
BIND 9 | =9.4.3-p1 | |
BIND 9 | =9.4.3-p2 | |
BIND 9 | =9.4.3-p3 | |
BIND 9 | =9.4.3-p4 | |
BIND 9 | =9.4.3-p5 | |
BIND 9 | =9.4.3-rc1 | |
BIND 9 | =9.6.0 | |
BIND 9 | =9.6.0-a1 | |
BIND 9 | =9.6.0-b1 | |
BIND 9 | =9.6.0-p1 | |
BIND 9 | =9.6.0-rc1 | |
BIND 9 | =9.6.0-rc2 | |
BIND 9 | =9.6.1 | |
BIND 9 | =9.6.1-b1 | |
BIND 9 | =9.6.1-p1 | |
BIND 9 | =9.6.1-p2 | |
BIND 9 | =9.6.1-rc1 | |
BIND 9 | =9.7.0-b1 | |
BIND 9 | =9.10.0 | |
BIND 9 | =9.10.0-a1 | |
BIND 9 | =9.10.0-a2 | |
BIND 9 | =9.10.0-b1 | |
BIND 9 | =9.10.0-b2 | |
BIND 9 | =9.10.0-p1 | |
BIND 9 | =9.10.0-p2 | |
BIND 9 | =9.10.0-rc1 | |
BIND 9 | =9.10.0-rc2 | |
BIND 9 | =9.10.1 | |
BIND 9 | =9.10.1-b1 | |
BIND 9 | =9.10.1-b2 | |
BIND 9 | =9.10.1-p1 | |
BIND 9 | =9.10.1-p2 | |
BIND 9 | =9.10.1-rc1 | |
BIND 9 | =9.10.1-rc2 | |
BIND 9 | =9.10.2-b1 | |
BIND 9 | =9.10.2-p1 | |
BIND 9 | =9.10.2-p2 | |
BIND 9 | =9.10.2-p3 | |
BIND 9 | =9.10.2-p4 | |
BIND 9 | =9.10.2-rc1 | |
BIND 9 | =9.10.2-rc2 | |
BIND 9 | =9.10.3 | |
BIND 9 | =9.10.3-b1 | |
BIND 9 | =9.10.3-p1 | |
BIND 9 | =9.10.3-p2 | |
BIND 9 | =9.10.3-p3 | |
BIND 9 | =9.10.3-rc1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of CVE-2010-0290 is considered high due to improper caching of DNS responses without DNSSEC validation.
To fix CVE-2010-0290, upgrade your BIND software to a version that includes the proper patches for this vulnerability.
CVE-2010-0290 affects multiple versions of BIND 9, including from 9.0 to 9.10.x.
The impact of CVE-2010-0290 includes potential cache poisoning and manipulation of DNS responses.
A temporary workaround for CVE-2010-0290 might involve disabling DNSSEC or adjusting caching settings, but upgrading to a patched version is the recommended solution.