Vulnerability in Compaq Tru64
CVE-2003-0914
ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL (time-to-live) value.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.032 (87.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 87.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.032 · newest: 0.032 · change: 0.000
Affected products
- Compaq Tru64 — versions 4.0f, 4.0f_pk6_bl17, 4.0f_pk7_bl18
- FreeBSD — versions 4.4, 4.5, 4.6
- HP Hp-Ux — versions 11.00, 11.11
- IBM Aix — versions 5.1l
- Isc Bind — versions 8.2.3, 8.2.4, 8.2.5
- NetBSD — versions 1.6, 1.6.1, current
- Nixu Namesurfer — versions standard_3.0.1, suite_3.0.1
- SCO Unixware — versions 7.1.1
- Sun Solaris — versions 7.0, 8.0, 9.0
- Sun Sunos — versions 5.7, 5.8
Public proof-of-concept exploits
References
- sunsolve.sun.com/pub-cgi/retrieve.pl (vendor-advisory)
- www.trustix.org/errata/misc/2003/TSL-2003-0044-bind.asc.txt (vendor-advisory)
- www.kb.cert.org/vuls/id/734644 (US Government Resource, Patch, Third Party Advisory, third-party-advisory)
- oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:2011 (signature, vdb-entry)
- www.debian.org/security/2004/dsa-409 (vendor-advisory, Patch, Vendor Advisory)
- secunia.com/advisories/10542 (third-party-advisory)
Frequently asked questions
- What is CVE-2003-0914?
- CVE-2003-0914 is a vulnerability in Compaq Tru64. Published 2003-12-15.
- Is CVE-2003-0914 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.