CVE-2009-0025: isc bind Improper Authentication

Modified

AliasesRHSA-2009:0020DEBIAN-CVE-2009-0025DSA-1703-1

Published 07-01-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-0025 is a medium (CVSS 6.8) Improper Authentication vulnerability in isc bind. EPSS estimates a 6.86% chance of exploitation in the next 30 days, higher than 94% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

6.86%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

07-01-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

6.86%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

No change 0.00 pp

From 6.86% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat9 products

bind< 0:9.2.1-11.el2 | < 20:9.2.4-23.el3 | < 20:9.2.4-30.el4_7.1 | < 30:9.3.4-6.0.3.P1.el5_2
bind-chroot< 20:9.2.4-23.el3 | < 20:9.2.4-30.el4_7.1 | < 30:9.3.4-6.0.3.P1.el5_2
bind-debuginfo< 20:9.2.4-23.el3 | < 20:9.2.4-30.el4_7.1 | < 30:9.3.4-6.0.3.P1.el5_2
bind-devel< 0:9.2.1-11.el2 | < 20:9.2.4-23.el3 | < 20:9.2.4-30.el4_7.1 | < 30:9.3.4-6.0.3.P1.el5_2
bind-libbind-devel< 30:9.3.4-6.0.3.P1.el5_2

Show all 9

Debian1 product

bind9< 1:9.3.4-2etch4 | < 1:9.5.1.dfsg.P1-1

Isc1 product

bind9.0 | 9.0.0:rc1 | 9.0.0:rc2 | 9.0.0:rc3 | 9.0.0:rc4 | 9.0.0:rc5 | 9.0.0:rc6 | 9.0.1 | 9.0.1:rc1 | 9.0.1:rc2 | 9.1 | 9.1.0:rc1 | 9.1.1 | 9.1.1:rc1 | 9.1.1:rc2 | 9.1.1:rc3 | 9.1.1:rc4 | 9.1.1:rc5 | 9.1.1:rc6 | 9.1.1:rc7 | 9.1.2 | 9.1.2:rc1 | 9.1.3 | 9.1.3:rc1 | 9.1.3:rc2 | 9.1.3:rc3 | 9.2.0 | 9.2.0:a1 | 9.2.0:a2 | 9.2.0:a3 | 9.2.0:b1 | 9.2.0:b2 | 9.2.0:rc1 | 9.2.0:rc10 | 9.2.0:rc2 | 9.2.0:rc3 | 9.2.0:rc4 | 9.2.0:rc5 | 9.2.0:rc6 | 9.2.0:rc7 | 9.2.0:rc8 | 9.2.0:rc9 | 9.2.1 | 9.2.1:rc1 | 9.2.1:rc2 | 9.2.2 | 9.2.2:p2 | 9.2.2:p3 | 9.2.2:rc1 | 9.2.3 | 9.2.3:rc1 | 9.2.3:rc2 | 9.2.3:rc3 | 9.2.3:rc4 | 9.2.4 | 9.2.4:rc2 | 9.2.4:rc3 | 9.2.4:rc4 | 9.2.4:rc5 | 9.2.4:rc6 | 9.2.4:rc7 | 9.2.4:rc8 | 9.2.5 | 9.2.5:b2 | 9.2.5:rc1 | 9.2.6 | 9.2.6:rc1 | 9.2.7 | 9.2.7:rc1 | 9.2.7:rc2 | 9.2.7:rc3 | 9.4 | 9.4.0 | 9.4.0:a1 | 9.4.0:a2 | 9.4.0:a3 | 9.4.0:a4 | 9.4.0:a5 | 9.4.0:a6 | 9.4.0:b1 | 9.4.0:b2 | 9.4.0:b3 | 9.4.0:b4 | 9.4.0:rc1 | 9.4.0:rc2 | 9.4.1 | 9.4.2 | 9.4.2:rc1 | 9.4.2:rc2 | 9.4.3 | 9.4.3:b1 | 9.4.3:b2 | 9.4.3:b3 | 9.4.3:rc1 | 9.5.0 | 9.5.1 | 9.6.0

3 vendors · 11 products