CVE-2007-0493

Description

Use-after-free vulnerability in ISC BIND 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (named daemon crash) via unspecified vectors that cause named to "dereference a freed fetch context."

7.8

CVSS

Severity: High

CVSS 2.0 •

EPSS 24.46% Top 5%

Vendor Advisory hp.com Vendor Advisory gentoo.org Vendor Advisory freebsd.org Vendor Advisory hp.com Vendor Advisory openpkg.com Vendor Advisory netbsd.org Vendor Advisory mandriva.com Vendor Advisory redhat.com Vendor Advisory trustix.org Vendor Advisory apple.com Vendor Advisory fedoranews.org Vendor Advisory ubuntu.com Vendor Advisory suse.com Vendor Advisory fedoranews.org Vendor Advisory slackware.com Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01070495	vendor advisory
http://docs.info.apple.com/article.html?artnum=305530
http://security.gentoo.org/glsa/glsa-200702-06.xml	vendor advisory
http://secunia.com/advisories/24129	third party advisory
http://secunia.com/advisories/24048	third party advisory
http://www.vupen.com/english/advisories/2007/1939	vdb entry
http://security.freebsd.org/advisories/FreeBSD-SA-07:02.bind.asc	vendor advisory
https://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00967144	vendor advisory
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.007.html	vendor advisory
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-003.txt.asc	vendor advisory
http://secunia.com/advisories/23943	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:030	vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-0057.html	vendor advisory
http://www.trustix.org/errata/2007/0005	vendor advisory
http://lists.apple.com/archives/security-announce/2007/May/msg00004.html	vendor advisory
http://secunia.com/advisories/25402	third party advisory
http://secunia.com/advisories/25649	third party advisory
http://secunia.com/advisories/24930	third party advisory
http://www.vupen.com/english/advisories/2007/2163	vdb entry
http://fedoranews.org/cms/node/2537	vendor advisory
http://secunia.com/advisories/23977	third party advisory
http://www.isc.org/index.pl?/sw/bind/view/?release=9.2.8	patch
http://www.isc.org/index.pl?/sw/bind/bind-security.php
http://www.ubuntu.com/usn/usn-418-1	vendor advisory
http://secunia.com/advisories/24203	third party advisory
http://secunia.com/advisories/24014	third party advisory
http://secunia.com/advisories/24054	third party advisory
http://secunia.com/advisories/23974	third party advisory
http://www.vupen.com/english/advisories/2007/2315	vdb entry
http://www.securityfocus.com/archive/1/458066/100/0/threaded	mailing list
http://lists.suse.com/archive/suse-security-announce/2007-Jan/0016.html	vendor advisory
https://issues.rpath.com/browse/RPL-989
http://www.isc.org/index.pl?/sw/bind/view/?release=9.3.4	patch
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488
http://marc.info/?l=bind-announce&m=116968519321296&w=2	mailing list
http://www.vupen.com/english/advisories/2007/1401	vdb entry
http://fedoranews.org/cms/node/2507	vendor advisory
http://secunia.com/advisories/23904	third party advisory vendor advisory
http://www.securityfocus.com/bid/22229	vdb entry
http://www.vupen.com/english/advisories/2007/0349	vdb entry
http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/052018.html	mailing list
http://securitytracker.com/id?1017561	vdb entry
http://secunia.com/advisories/23924	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9614	signature vdb entry
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.494157	vendor advisory
http://secunia.com/advisories/24950	third party advisory
http://secunia.com/advisories/23972	third party advisory

Frequently Asked Questions

What is the severity of CVE-2007-0493?: CVE-2007-0493 has been scored as a high severity vulnerability.
How to fix CVE-2007-0493?: To fix CVE-2007-0493, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2007-0493 being actively exploited in the wild?: It is possible that CVE-2007-0493 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~24% probability that this vulnerability will be exploited by malicious actors in the next 30 days.