CVE-2002-0029

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Buffer overflows in the DNS stub resolver library in ISC BIND 4.9.2 through 4.9.10, and other derived libraries such as BSD libc and GNU glibc, allow remote attackers to execute arbitrary code via DNS server responses that trigger the overflow in the (1) getnetbyname, or (2) getnetbyaddr functions, aka "LIBRESOLV: buffer overrun" and a different vulnerability than CVE-2002-0684.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/Security-announce/2002/Nov/msg00000.html
http://www.cert.org/advisories/CA-2002-31.htmlPatch, Third Party Advisory, US Government Resource
http://www.isc.org/products/BIND/bind-security.htmlPatch, Vendor Advisory
http://www.iss.net/security_center/static/10624.phpVendor Advisory
http://www.kb.cert.org/vuls/id/844360US Government Resource
http://www.securityfocus.com/bid/6186
http://lists.apple.com/archives/Security-announce/2002/Nov/msg00000.html
http://www.cert.org/advisories/CA-2002-31.htmlPatch, Third Party Advisory, US Government Resource
http://www.isc.org/products/BIND/bind-security.htmlPatch, Vendor Advisory
http://www.iss.net/security_center/static/10624.phpVendor Advisory
http://www.kb.cert.org/vuls/id/844360US Government Resource
http://www.securityfocus.com/bid/6186

Timeline

Published: Nov 29, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-00304.6The digital signature mechanism for the Adobe Acrobat PDF viewer only verifies the PE header of executable code for a plug-in, which can all CVE-2002-00314.6Buffer overflows in Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary code via a ymsgr URI with long argu CVE-2002-00327.5Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary script as other users via the addview parameter of a ym CVE-2002-003310.0Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with CVE-2002-00344.6The Microsoft CONVERT.EXE program, when used on Windows 2000 and Windows XP systems, does not apply the default NTFS permissions when conver CVE-2002-00365.0Integer signedness error in MIT Kerberos V5 ASN.1 decoder before krb5 1.2.5 allows remote attackers to cause a denial of service via a large CVE-2002-00377.5Lotus Domino Servers 5.x, 4.6x, and 4.5x allows attackers to bypass the intended Reader and Author access list for a document's object via a CVE-2002-00385.0Vulnerability in the cache-limiting function of the unified name service daemon (nsd) in IRIX 6.5.4 through 6.5.11 allows remote attackers t CVE-2002-00395.0rpcbind in SGI IRIX 6.5 through 6.5.15f, and possibly earlier versions, allows remote attackers to cause a denial of service (crash) via mal CVE-2002-00402.1Vulnerability in SGI IRIX 6.5.11 through 6.5.15f allows local users to cause privileged applications to dump core via the HOSTALIASES enviro CVE-2002-00415.0Unknown vulnerability in Mail for SGI IRIX 6.5 through 6.5.15f, and possibly earlier versions, when running with the -R option, allows local CVE-2002-00422.1Vulnerability in the XFS file system for SGI IRIX before 6.5.12 allows local users to cause a denial of service (hang) by creating a file th