CVE-2001-0497

Published: Jul 21, 2001Modified: Apr 16, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

dnskeygen in BIND 8.2.4 and earlier, and dnssec-keygen in BIND 9.1.2 and earlier, set insecure permissions for a HMAC-MD5 shared secret key file used for DNS Transactional Signatures (TSIG), which allows attackers to obtain the keys and perform dynamic DNS updates.

Affected (2)

Products: Isc: Bind

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Isc Bind	Up to 8.2.4
Isc Bind	From 9.0 to 9.1.2

Related CWEs

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (6)

http://www.osvdb.org/5609

Source: cve@mitre.org

Broken Link

http://xforce.iss.net/alerts/advise78.php

Source: cve@mitre.org

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/6694

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.osvdb.org/5609

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://xforce.iss.net/alerts/advise78.php

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/6694

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.