National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2007-0493 Detail

Description

Use-after-free vulnerability in ISC BIND 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (named daemon crash) via unspecified vectors that cause named to "dereference a freed fetch context."

Source:  MITRE      Last Modified:  01/25/2007

Quick Info

CVE Dictionary Entry:
CVE-2007-0493
Original release date:
01/25/2007
Last revised:
10/10/2017
Source:
US-CERT/NIST

Impact

CVSS Severity (version 2.0):
CVSS v2 Base Score:
7.8 HIGH
Vector:
(AV:N/AC:L/Au:N/C:N/I:N/A:C) (legend)
Impact Subscore:
6.9
Exploitability Subscore:
10.0
CVSS Version 2 Metrics:
Access Vector:
Network exploitable
Access Complexity:
Low
Authentication:
Not required to exploit
Impact Type:
Allows disruption of service

Vendor Statements (disclaimer)

Official Statement from Red Hat (01/29/2007)

Not vulnerable. This issue did not affect the versions of ISC BIND as shipped with Red Hat Enterprise Linux 2.1, 3, or 4.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource Type Source Name
http://docs.info.apple.com/article.html?artnum=305530 External Source CONFIRM http://docs.info.apple.com/article.html?artnum=305530
http://fedoranews.org/cms/node/2507 External Source FEDORA FEDORA-2007-147
http://fedoranews.org/cms/node/2537 External Source FEDORA FEDORA-2007-164
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-003.txt.asc External Source NETBSD NetBSD-SA2007-003
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01070495 External Source HP SSRT061273
http://lists.apple.com/archives/security-announce/2007/May/msg00004.html External Source APPLE APPLE-SA-2007-05-24
http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/052018.html External Source FULLDISC 20070125 BIND remote exploit (low severity) [Fwd: Internet Systems Consortium Security Advisory.]
http://lists.suse.com/archive/suse-security-announce/2007-Jan/0016.html External Source SUSE SUSE-SA:2007:014
http://marc.info/?l=bind-announce&m=116968519321296&w=2 External Source MLIST [bind-announce] 20070125 Internet Systems Consortium Security Advisory.
http://security.freebsd.org/advisories/FreeBSD-SA-07:02.bind.asc External Source FREEBSD FreeBSD-SA-07:02
http://security.gentoo.org/glsa/glsa-200702-06.xml External Source GENTOO GLSA-200702-06
http://securitytracker.com/id?1017561 External Source SECTRACK 1017561
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.494157 External Source SLACKWARE SSA:2007-026-01
http://www.isc.org/index.pl?/sw/bind/bind-security.php External Source CONFIRM http://www.isc.org/index.pl?/sw/bind/bind-security.php
http://www.isc.org/index.pl?/sw/bind/view/?release=9.2.8 Patch External Source CONFIRM http://www.isc.org/index.pl?/sw/bind/view/?release=9.2.8
http://www.isc.org/index.pl?/sw/bind/view/?release=9.3.4 Patch External Source CONFIRM http://www.isc.org/index.pl?/sw/bind/view/?release=9.3.4
http://www.mandriva.com/security/advisories?name=MDKSA-2007:030 External Source MANDRIVA MDKSA-2007:030
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.007.html External Source OPENPKG OpenPKG-SA-2007.007
http://www.redhat.com/support/errata/RHSA-2007-0057.html External Source REDHAT RHSA-2007:0057
http://www.securityfocus.com/archive/1/archive/1/458066/100/0/threaded External Source BUGTRAQ 20070125 BIND remote exploit (low severity) [Fwd: Internet Systems Consortium Security Advisory.]
http://www.securityfocus.com/bid/22229 External Source BID 22229
http://www.trustix.org/errata/2007/0005 External Source TRUSTIX 2007-0005
http://www.ubuntu.com/usn/usn-418-1 External Source UBUNTU USN-418-1
http://www.vupen.com/english/advisories/2007/0349 External Source VUPEN ADV-2007-0349
http://www.vupen.com/english/advisories/2007/1401 External Source VUPEN ADV-2007-1401
http://www.vupen.com/english/advisories/2007/1939 External Source VUPEN ADV-2007-1939
http://www.vupen.com/english/advisories/2007/2163 External Source VUPEN ADV-2007-2163
http://www.vupen.com/english/advisories/2007/2315 External Source VUPEN ADV-2007-2315
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488 External Source CONFIRM https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488
https://issues.rpath.com/browse/RPL-989 External Source CONFIRM https://issues.rpath.com/browse/RPL-989
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9614 External Source OVAL oval:org.mitre.oval:def:9614
https://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144 External Source HP SSRT061213

References to Check Content

Identifier:
oval:org.mitre.oval:def:9614
Check System:
http://oval.mitre.org/XMLSchema/oval-definitions-5
Hyperlink:
http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9614

Technical Details

Vulnerability Type (View All)

Change History 5 change records found - show changes