CVE-2001-0497 Information disclosure in n/a

High 7.8 Published 9 Mar 2002 Updated 8 Aug 2024

Insecure file permissions on TSIG key files allow attackers to read keys and perform unauthorized dynamic DNS updates.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2001-0497?

CVE-2001-0497 is a high-severity vulnerability in Isc Bind, published on 9 Mar 2002. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

dnskeygen in BIND 8.2.4 and earlier, and dnssec-keygen in BIND 9.1.2 and earlier, set insecure permissions for a HMAC-MD5 shared secret key file used for DNS Transactional Signatures (TSIG), which allows attackers to obtain the keys and perform dynamic DNS updates.

Weakness: CWE-276

Which versions are affected by CVE-2001-0497?

It affects 1 product.

Products include Isc Bind.

How do I fix CVE-2001-0497?

No fix has been published for CVE-2001-0497 yet. Limit exposure of the affected software until one is available.

Is CVE-2001-0497 being exploited?

There is no known exploitation of CVE-2001-0497 in the wild and no public exploit code.

All Isc Bind vulnerabilities

Sources

Also known as GHSA-r698-fc6p-rp6g.