CVE-2009-0025
- State
- Published
- Severity
- Not scored
- Published
- Jan 7, 2009
- Updated
- Aug 7, 2024
- Reserved
- Dec 15, 2008
Description
BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://www.vmware.com/security/advisories/VMSA-2009-0004.html
- HPSBOV03226vendor-advisory
- 33151vdb-entry
- http://support.apple.com/kb/HT3549
- 20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misusesmailing-list
- https://issues.rpath.com/browse/RPL-2938
- http://www.openbsd.org/errata44.html#008_bind
- http://wiki.rpath.com/Advisories:rPSA-2009-0009
- 33546third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2009-045.htm
- 35074third-party-advisory
- oval:org.mitre.oval:def:5569vdb-entrysignature
- 33559third-party-advisory
- 250846vendor-advisory
- APPLE-SA-2009-05-12vendor-advisory
- ADV-2009-0904vdb-entry
- ADV-2009-0043vdb-entry
- http://www.ocert.org/advisories/ocert-2008-016.html
- 20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vimmailing-list
- FreeBSD-SA-09:04vendor-advisory
- SSA:2009-014-02vendor-advisory
- 33882third-party-advisory
- oval:org.mitre.oval:def:10879vdb-entrysignature
- https://www.isc.org/software/bind/advisories/cve-2009-0025
- TA09-133Athird-party-advisory
- http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33
- ADV-2009-1297vdb-entry
- 33683third-party-advisory
- ADV-2009-0366vdb-entry
- 20090120 rPSA-2009-0009-1 bind bind-utilsmailing-list
- 33494third-party-advisory
- 33551third-party-advisory
- FEDORA-2009-0350vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.