Description
BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.5.1.dfsg.P1-1 | — |
| Debian 13 | bind9 | 1:9.5.1.dfsg.P1-1 | — |
| Debian 12 | bind9 | 1:9.5.1.dfsg.P1-1 | — |
| Debian 4.0 | bind9 | 1:9.3.4-2etch4 | DSA-1703-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | bind +7 | 30:9.3.4-6.0.3.P1.el5_2 | RHSA-2009:0020 |
| RHEL 4 | bind +4 | 20:9.2.4-30.el4_7.1 | RHSA-2009:0020 |
| RHEL 3 | bind +4 | 20:9.2.4-23.el3 | RHSA-2009:0020 |
| RHEL 2 | bind +2 | 9.2.1-11.el2 | RHSA-2009:0020 |
Advisories 2
- RHSA-2009:0020 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1703-1 bind9 - cryptographic weakness Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.vmware.com/security/advisories/VMSA-2009-0004.html
- HPSBOV03226 vendor-advisory
- 33151 vdb-entry
- http://support.apple.com/kb/HT3549
- 20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misuses mailing-list
- https://issues.rpath.com/browse/RPL-2938
- http://www.openbsd.org/errata44.html#008_bind
- http://wiki.rpath.com/Advisories:rPSA-2009-0009
- 33546 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2009-045.htm
- 35074 third-party-advisory
- oval:org.mitre.oval:def:5569 vdb-entry signature
- 33559 third-party-advisory
- 250846 vendor-advisory
- APPLE-SA-2009-05-12 vendor-advisory
- ADV-2009-0904 vdb-entry
- ADV-2009-0043 vdb-entry
- http://www.ocert.org/advisories/ocert-2008-016.html
- 20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim mailing-list
- FreeBSD-SA-09:04 vendor-advisory
- SSA:2009-014-02 vendor-advisory
- 33882 third-party-advisory
- oval:org.mitre.oval:def:10879 vdb-entry signature
- https://www.isc.org/software/bind/advisories/cve-2009-0025
- TA09-133A third-party-advisory
- http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33
- ADV-2009-1297 vdb-entry
- 33683 third-party-advisory
- ADV-2009-0366 vdb-entry
- 20090120 rPSA-2009-0009-1 bind bind-utils mailing-list
- 33494 third-party-advisory
- 33551 third-party-advisory
- FEDORA-2009-0350 vendor-advisory