Full Disclosure mailing list archives
Re: On the impact of CVE-2013-2266 (BIND9)
From: Jeff Wright <jwright () isc org>
Date: Thu, 28 Mar 2013 15:35:27 -0400
In response to comments on this list from Daniel Franke, describing a possible exploitation scenario for the CVE-2013-2266 vulnerability, ISC would like to point out that the vector identified by Mr. Franke is not the only one possible, and that operators of *ANY* recursive *OR* authoritative nameservers running an unpatched installation of an affected version of BIND should consider themselves vulnerable to this security issue. We wish, however, to express agreement with the main point of Mr. Franke's comment, which is that the required complexity of the exploit for this vulnerability is not high, and immediate action is recommended to ensure your nameservers are not at risk. Jeff Wright _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- On the impact of CVE-2013-2266 (BIND9) Daniel Franke (Mar 27)
- <Possible follow-ups>
- Re: On the impact of CVE-2013-2266 (BIND9) Jeff Wright (Mar 28)