CVE - CVE-2009-3602

CVE-ID
CVE-2009-3602	Learn more at National Vulnerability Database (NVD) • Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings
Description
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MLIST:[Unbound-users] 20091007 Release of unbound 1.3.4 URL:http://unbound.net/pipermail/unbound-users/2009-October/000852.html MLIST:[oss-security] 20091009 CVE request: Unbound URL:http://www.openwall.com/lists/oss-security/2009/10/09/2 MLIST:[oss-security] 20091009 Re: CVE request: Unbound URL:http://www.openwall.com/lists/oss-security/2009/10/09/3 DEBIAN:DSA-1963 URL:http://www.debian.org/security/2009/dsa-1963 OSVDB:58836 URL:http://osvdb.org/58836 SECUNIA:36996 URL:http://secunia.com/advisories/36996 SECUNIA:37913 URL:http://secunia.com/advisories/37913 VUPEN:ADV-2009-2875 URL:http://www.vupen.com/english/advisories/2009/2875 XF:unbound-nsec3-security-bypass(53729) URL:http://xforce.iss.net/xforce/xfdb/53729
Date Entry Created
20091009	Disclaimer: The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20091009)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE list, which standardizes names for security problems.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org

Use of the Common Vulnerabilities and Exposures List and the associated references from this Web site are subject to the Terms of Use. For more information, please email cve@mitre.org.

CVE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Copyright © 1999–2017, The MITRE Corporation. CVE and the CVE logo are registered trademarks and CVE-Compatible is a trademark of The MITRE Corporation.

Site Map
Privacy policy
Terms of use
Contact us