CVE-2010-3615 Missing authorization in n/a

Medium 5.0 Published 3 Dec 2010 Updated 7 Aug 2024

Remote attackers can bypass access controls to read private DNS records due to improper ACL checks in ISC BIND.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2010-3615?

CVE-2010-3615 is a medium-severity missing authorization vulnerability in Isc Bind, published on 3 Dec 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

named in ISC BIND 9.7.2-P2 does not check all intended locations for allow-query ACLs, which might allow remote attackers to make successful requests for private DNS records via the standard DNS query mechanism.

Weakness: CWE-264

Which versions are affected by CVE-2010-3615?

It affects 1 product.

Products include Isc Bind.

How do I fix CVE-2010-3615?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2010-3615 being exploited?

There is no known exploitation of CVE-2010-3615 in the wild and no public exploit code.

All Isc Bind vulnerabilities

Sources

Also known as DEBIAN-CVE-2010-3615, GHSA-j2v8-rqc3-xfr2.