Vulnerability Intelligence Report
CVE-2013-4854
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.
No Active Exploit Signals
CVSS Base Score
7.8
HIGH
EPSS Probability:34.15%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| isc | bind | 9.7.0, 9.7.1, 9.7.2, 9.7.3, 9.7.4, 9.7.5, 9.7.6, 9.7.7, 9.9.0, 9.9.1, 9.9.2, 9.9.3, 9.8.0, 9.8.1, 9.8.2, 9.8.3, 9.8.4, 9.8.5, 9.8.6 |
| suse | suse_linux_enterprise_software_development_kit | 11.0 |
| novell | suse_linux | 11 |
| isc | dnsco_bind | 9.9.3, 9.9.4 |
| opensuse | opensuse | 11.4 |
| freebsd | freebsd | 8.0, 8.1, 8.2, 8.3, 8.4, 9.0, 9.1, 9.2 |
| mandriva | business_server | 1.0 |
| mandriva | enterprise_server | 5.0 |
| redhat | enterprise_linux | 5, 6.0 |
| fedoraproject | fedora | 18, 19 |
| hp | hp-ux | b.11.31 |
| slackware | slackware_linux | 12.1, 12.2, 13.0, 13.1, 13.37 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
34.150%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2013-07-16T00:00:00 |
| Published | 2013-07-26T23:00:00 |
| Patch Date | 2013-07-26 |
| Last Updated | 2024-08-06T16:59:39 |
Community Chatter & Buzz