CVE - CVE-2009-0025

CVE-ID
CVE-2009-0025	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misuses URL:http://www.securityfocus.com/archive/1/499827/100/0/threaded MISC:20090120 rPSA-2009-0009-1 bind bind-utils URL:http://www.securityfocus.com/archive/1/500207/100/0/threaded MISC:20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim URL:http://www.securityfocus.com/archive/1/502322/100/0/threaded MISC:250846 URL:~~http://sunsolve.sun.com/search/document.do?assetkey=1-26-250846-1~~ (Obsolete source) MISC:33151 URL:http://www.securityfocus.com/bid/33151 MISC:33494 URL:http://secunia.com/advisories/33494 MISC:33546 URL:http://secunia.com/advisories/33546 MISC:33551 URL:http://secunia.com/advisories/33551 MISC:33559 URL:http://secunia.com/advisories/33559 MISC:33683 URL:http://secunia.com/advisories/33683 MISC:33882 URL:http://secunia.com/advisories/33882 MISC:35074 URL:http://secunia.com/advisories/35074 MISC:ADV-2009-0043 URL:~~http://www.vupen.com/english/advisories/2009/0043~~ (Obsolete source) MISC:ADV-2009-0366 URL:~~http://www.vupen.com/english/advisories/2009/0366~~ (Obsolete source) MISC:ADV-2009-0904 URL:~~http://www.vupen.com/english/advisories/2009/0904~~ (Obsolete source) MISC:ADV-2009-1297 URL:~~http://www.vupen.com/english/advisories/2009/1297~~ (Obsolete source) MISC:APPLE-SA-2009-05-12 URL:http://lists.apple.com/archives/security-announce/2009/May/msg00002.html MISC:FEDORA-2009-0350 URL:https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00393.html MISC:FreeBSD-SA-09:04 URL:http://security.freebsd.org/advisories/FreeBSD-SA-09:04.bind.asc MISC:HPSBOV03226 URL:http://marc.info/?l=bugtraq&m=141879471518471&w=2 MISC:SSA:2009-014-02 URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.540362 MISC:SSRT101004 URL:http://marc.info/?l=bugtraq&m=141879471518471&w=2 MISC:TA09-133A URL:http://www.us-cert.gov/cas/techalerts/TA09-133A.html MISC:http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33 URL:http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33 MISC:http://support.apple.com/kb/HT3549 URL:http://support.apple.com/kb/HT3549 MISC:http://support.avaya.com/elmodocs2/security/ASA-2009-045.htm URL:http://support.avaya.com/elmodocs2/security/ASA-2009-045.htm MISC:http://wiki.rpath.com/Advisories:rPSA-2009-0009 URL:http://wiki.rpath.com/Advisories:rPSA-2009-0009 MISC:http://www.ocert.org/advisories/ocert-2008-016.html URL:http://www.ocert.org/advisories/ocert-2008-016.html MISC:http://www.openbsd.org/errata44.html#008_bind URL:http://www.openbsd.org/errata44.html#008_bind MISC:http://www.vmware.com/security/advisories/VMSA-2009-0004.html URL:http://www.vmware.com/security/advisories/VMSA-2009-0004.html MISC:https://issues.rpath.com/browse/RPL-2938 URL:https://issues.rpath.com/browse/RPL-2938 MISC:https://www.isc.org/software/bind/advisories/cve-2009-0025 URL:https://www.isc.org/software/bind/advisories/cve-2009-0025 MISC:oval:org.mitre.oval:def:10879 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10879 MISC:oval:org.mitre.oval:def:5569 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5569
Assigning CNA
Red Hat, Inc.
Date Record Created
20081215	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20081215)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)