CVE-2009-0025

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-01-07 · updated 2026-06-16
Weakness: CWE-287

Description

BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.

Affected products

ISC BIND: 9.0, 9.0.0-rc1, 9.0.0-rc2, 9.0.0-rc3, 9.0.0-rc4, 9.0.0-rc5 (+91)

References

http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://marc.info/?l=bugtraq&m=141879471518471&w=2
http://secunia.com/advisories/33494
http://secunia.com/advisories/33546
http://secunia.com/advisories/33551
http://secunia.com/advisories/33559
http://secunia.com/advisories/33683
http://secunia.com/advisories/33882
http://secunia.com/advisories/35074
http://security.freebsd.org/advisories/FreeBSD-SA-09:04.bind.asc
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.540362

Get alerted when CVE-2009-0025 or the next vulnerability affects your stack