MEDIUM
bind: failure to clear existing RRSIG records when a NO DATA is negatively cached could DoS named
Published Dec 3, 2010
4.0
MEDIUMCVSS 2.0
EPSS 9.10%
Description
named in ISC BIND 9.6.2 before 9.6.2-P3, 9.6-ESV before 9.6-ESV-R3, and 9.7.x before 9.7.2-P3 does not properly handle the combination of signed negative responses and corresponding RRSIG records in the cache, which allows remote attackers to cause a denial of service (daemon crash) via a query for cached data.
Affected products
No data.
OR
- 9.6
- 9.6
- 9.6
- 9.6.2
- 9.6.2
- 9.6.2
- 9.6.2
- 9.7.0
- 9.7.0
- 9.7.0
- 9.7.0
- 9.7.0
- 9.7.0
- 9.7.0
- 9.7.0
- 9.7.0
- 9.7.0
- 9.7.0
- 9.7.1
- 9.7.1
- 9.7.1
- 9.7.1
- 9.7.1
- 9.7.2
- 9.7.2
- 9.7.2
No data.
Red Hat Enterprise Linux 4
bind-20:9.2.4-30.el4_8.6
Fixed · RHSA-2010:1000
Red Hat Enterprise Linux 5
bind-30:9.3.6-4.P1.el5_5.3
Fixed · RHSA-2010:0976
Red Hat Enterprise Linux 6
bind-32:9.7.0-5.P2.el6_0.1
Fixed · RHSA-2010:0975
Red Hat Enterprise Linux 5
bind97
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 4 | bind-20:9.2.4-30.el4_8.6 | Fixed | RHSA-2010:1000 |
| Red Hat Enterprise Linux 5 | bind-30:9.3.6-4.P1.el5_5.3 | Fixed | RHSA-2010:0976 |
| Red Hat Enterprise Linux 6 | bind-32:9.7.0-5.P2.el6_0.1 | Fixed | RHSA-2010:0975 |
| Red Hat Enterprise Linux 5 | bind97 | Affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
4.0 MEDIUM NVD
AV:N/AC:L/Au:S/C:N/I:N/A:P
Access Vector Network
Access Complexity Low
Authentication Single
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
9.10% 0.09100
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
EPSS probability 0.09100
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (16 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 9.10% (0.09100) | 95.17th | v5 (v2026.06.15) |
| Jul 13, 2026 | 9.10% (0.09100) | 94.70th | v5 (v2026.06.15) |
| Jun 15, 2026 | 10.66% (0.10655) | 95.21th | v5 (v2026.06.15) |
| Sep 16, 2025 | 3.21% (0.03207) | 86.53th | v4 (v2025.03.14) |
| Mar 30, 2025 | 1.90% (0.01902) | 81.62th | v4 (v2025.03.14) |
| Mar 29, 2025 | 3.35% (0.03353) | 78.70th | v4 (v2025.03.14) |
| Mar 19, 2025 | 1.90% (0.01902) | 81.32th | v4 (v2025.03.14) |
| Mar 17, 2025 | 3.06% (0.03060) | 85.80th | v4 (v2025.03.14) |
| Dec 17, 2024 | 2.73% (0.02732) | 90.25th | v3 (v2023.03.01) |
| Feb 3, 2024 | 1.38% (0.01380) | 84.97th | v3 (v2023.03.01) |
| Nov 1, 2023 | 0.99% (0.00987) | 81.83th | v3 (v2023.03.01) |
| Sep 12, 2023 | 1.13% (0.01131) | 82.92th | v3 (v2023.03.01) |
| Mar 7, 2023 | 1.38% (0.01380) | 84.23th | v3 (v2023.03.01) |
| Mar 6, 2023 | 16.94% (0.16942) | 96.20th | v2 (v2022.01.01) |
| Apr 1, 2022 | 16.94% (0.16942) | 95.84th | v2 (v2022.01.01) |
| Feb 4, 2022 | 16.94% (0.16942) | 93.01th | v2 (v2022.01.01) |
Weaknesses (1)
References (41)
- http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2011-001.txt.asc vendor-advisoryx_refsource_NETBSD
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html vendor-advisoryx_refsource_APPLE
- http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051910.html vendor-advisoryx_refsource_FEDORA
- http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051963.html vendor-advisoryx_refsource_FEDORA
- http://lists.vmware.com/pipermail/security-announce/2011/000126.html mailing-listx_refsource_MLIST
- http://marc.info/?l=bugtraq&m=130270720601677&w=2 vendor-advisoryx_refsource_HP
- http://secunia.com/advisories/42374 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/42459 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/42522 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/42671 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/42707 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/43141 third-party-advisoryx_refsource_SECUNIA
- http://securitytracker.com/id?1024817 vdb-entryx_refsource_SECTRACK
- http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.622190 vendor-advisoryx_refsource_SLACKWARE
- http://support.apple.com/kb/HT5002 x_refsource_CONFIRM
- http://support.avaya.com/css/P8/documents/100124923 x_refsource_CONFIRM
- http://www.debian.org/security/2010/dsa-2130 vendor-advisoryx_refsource_DEBIAN
- http://www.isc.org/announcement/guidance-regarding-dec-1st-2010-security-advisories x_refsource_CONFIRM
- http://www.isc.org/software/bind/advisories/cve-2010-3613 x_refsource_CONFIRMVendor Advisory
- http://www.kb.cert.org/vuls/id/706148 third-party-advisoryx_refsource_CERT-VNUS Government Resource
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:253 vendor-advisoryx_refsource_MANDRIVA
- http://www.osvdb.org/69558 vdb-entryx_refsource_OSVDB
- http://www.redhat.com/support/errata/RHSA-2010-0975.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2010-0976.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2010-1000.html vendor-advisoryx_refsource_REDHAT
- http://www.securityfocus.com/archive/1/516909/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/bid/45133 vdb-entryx_refsource_BID
- http://www.ubuntu.com/usn/USN-1025-1 vendor-advisoryx_refsource_UBUNTU
- http://www.vmware.com/security/advisories/VMSA-2011-0004.html x_refsource_CONFIRM
- http://www.vupen.com/english/advisories/2010/3102 vdb-entryx_refsource_VUPENVendor Advisory
- http://www.vupen.com/english/advisories/2010/3103 vdb-entryx_refsource_VUPENVendor Advisory
- http://www.vupen.com/english/advisories/2010/3138 vdb-entryx_refsource_VUPENVendor Advisory
- http://www.vupen.com/english/advisories/2010/3139 vdb-entryx_refsource_VUPENVendor Advisory
- http://www.vupen.com/english/advisories/2010/3140 vdb-entryx_refsource_VUPENVendor Advisory
- http://www.vupen.com/english/advisories/2011/0267 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2011/0606 vdb-entryx_refsource_VUPEN
- https://access.redhat.com/security/cve/CVE-2010-3613 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=658974 Issue Tracking
- https://nvd.nist.gov/vuln/detail/CVE-2010-3613
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12601 vdb-entrysignaturex_refsource_OVAL
- https://www.cve.org/CVERecord?id=CVE-2010-3613
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner certcc
Published Dec 3, 2010
Updated Aug 7, 2024
Reserved Sep 27, 2010
Link CVE-2010-3613
CISA Vulnrichment
Updated n/a