[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <55CB3CE9.1030104@redhat.com>
Date: Wed, 12 Aug 2015 14:32:41 +0200
From: Florian Weimer <fweimer@...hat.com>
To: ISC Security Officer <security-officer@....org>,
Assign a CVE Identifier <cve-assign@...re.org>
Cc: oss-security@...ts.openwall.com
Subject: Is CVE-2015-4650 a duplicate, leak, or just a typo?
Some documents use CVE-2015-4650 to refer to a vulnerability in BIND.
Apparently, they source back to
<https://www.alienvault.com/forums/discussion/5706/security-advisory-alienvault-v5-1-addresses-6-vulnerabilities>
which says:
“
Debian Security Update
AlienVault ID: ENG-101265
Description: name.c in named in ISC BIND 9.7.x through 9.9.x before
9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive
resolver with DNSSEC validation, allows remote attackers to cause a
denial of service (REQUIRE assertion failure and daemon exit) by
constructing crafted zone data and then making a query for a name in
that zone.
CVE ID: CVE-2015-4650
CVSS v2 Base Score: 7.8
CVSS v2 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:N)
”
That description seems to match CVE-2015-4620, so I'm leaning towards typo:
<https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4620>
I don't know how this came into being. Debian does not appear
responsible, the immutable list archives use the correct ID:
<https://lists.debian.org/debian-lts-announce/2015/07/msg00008.html>
<https://lists.debian.org/debian-security-announce/2015/msg00200.html>
Comments appreciated.
--
Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
