CVE-2012-5166
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6...
7.8 HighFix available
CVE-2012-5166 is a high vulnerability (CVSS 7.8) in Isc Bind, published October 10, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 32.7%, the 98th percentile. Fixed in bind9 1:9.8.1.dfsg.P1-4.3.
- Severity
- 7.8 HighCVSS 2.0, NVD
- Exploit chance
- 32.7%EPSS, 98th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1:9.8.1.dfsg.P1-4.3bind9 +76 more
Description
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.
Exploit likelihood
32.7%Up 6.3 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bind9Debian:12 | before 1:9.8.1.dfsg.P1-4.3 | 1:9.8.1.dfsg.P1-4.3 |
bind9Debian:13 | before 1:9.8.1.dfsg.P1-4.3 | 1:9.8.1.dfsg.P1-4.3 |
bind9Debian:14 | before 1:9.8.1.dfsg.P1-4.3 | 1:9.8.1.dfsg.P1-4.3 |
bind9Debian:6.0 | before 1:9.7.3.dfsg-1~squeeze8, plus listed versions 1:9.7.2.dfsg.P3-1.11:9.7.3.dfsg-1~squeeze11:9.7.3.dfsg-1~squeeze1~bpo50+11:9.7.3.dfsg-1~squeeze21:9.7.3.dfsg-1~squeeze2~bpo50+1 Show 6 moreShow less1:9.7.3.dfsg-1~squeeze31:9.7.3.dfsg-1~squeeze3~bpo50+11:9.7.3.dfsg-1~squeeze41:9.7.3.dfsg-1~squeeze51:9.7.3.dfsg-1~squeeze61:9.7.3.dfsg-1~squeeze7 | 1:9.7.3.dfsg-1~squeeze8 |
bindRed Hat:enterprise_linux:5::client | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-debuginfoRed Hat:enterprise_linux:5::client | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-libsRed Hat:enterprise_linux:5::client | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-sdbRed Hat:enterprise_linux:5::client | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-utilsRed Hat:enterprise_linux:5::client | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bindRed Hat:enterprise_linux:5::client_workstation | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
Show 67 moreShow less
| Package | Affected | Fixed |
|---|---|---|
bind-chrootRed Hat:enterprise_linux:5::client_workstation | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-debuginfoRed Hat:enterprise_linux:5::client_workstation | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-develRed Hat:enterprise_linux:5::client_workstation | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-libbind-develRed Hat:enterprise_linux:5::client_workstation | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
caching-nameserverRed Hat:enterprise_linux:5::client_workstation | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bindRed Hat:enterprise_linux:5::server | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-chrootRed Hat:enterprise_linux:5::server | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-debuginfoRed Hat:enterprise_linux:5::server | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-develRed Hat:enterprise_linux:5::server | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-libbind-develRed Hat:enterprise_linux:5::server | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-libsRed Hat:enterprise_linux:5::server | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-sdbRed Hat:enterprise_linux:5::server | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bind-utilsRed Hat:enterprise_linux:5::server | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
caching-nameserverRed Hat:enterprise_linux:5::server | before 30:9.3.6-20.P1.el5_8.5 | 30:9.3.6-20.P1.el5_8.5 |
bindRed Hat:enterprise_linux:6::client | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-debuginfoRed Hat:enterprise_linux:6::client | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-libsRed Hat:enterprise_linux:6::client | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-utilsRed Hat:enterprise_linux:6::client | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-chrootRed Hat:enterprise_linux:6::client | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-develRed Hat:enterprise_linux:6::client | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-sdbRed Hat:enterprise_linux:6::client | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bindRed Hat:enterprise_linux:6::computenode | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-debuginfoRed Hat:enterprise_linux:6::computenode | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-libsRed Hat:enterprise_linux:6::computenode | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-utilsRed Hat:enterprise_linux:6::computenode | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-chrootRed Hat:enterprise_linux:6::computenode | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-develRed Hat:enterprise_linux:6::computenode | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-sdbRed Hat:enterprise_linux:6::computenode | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bindRed Hat:enterprise_linux:6::server | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-chrootRed Hat:enterprise_linux:6::server | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-debuginfoRed Hat:enterprise_linux:6::server | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-libsRed Hat:enterprise_linux:6::server | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-utilsRed Hat:enterprise_linux:6::server | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-develRed Hat:enterprise_linux:6::server | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-sdbRed Hat:enterprise_linux:6::server | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bindRed Hat:enterprise_linux:6::workstation | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-chrootRed Hat:enterprise_linux:6::workstation | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-debuginfoRed Hat:enterprise_linux:6::workstation | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-libsRed Hat:enterprise_linux:6::workstation | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-utilsRed Hat:enterprise_linux:6::workstation | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-develRed Hat:enterprise_linux:6::workstation | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind-sdbRed Hat:enterprise_linux:6::workstation | before 32:9.8.2-0.10.rc1.el6_3.5 | 32:9.8.2-0.10.rc1.el6_3.5 |
bind97Red Hat:enterprise_linux:5::client_workstation | before 32:9.7.0-10.P2.el5_8.4 | 32:9.7.0-10.P2.el5_8.4 |
bind97-chrootRed Hat:enterprise_linux:5::client_workstation | before 32:9.7.0-10.P2.el5_8.4 | 32:9.7.0-10.P2.el5_8.4 |
bind97-debuginfoRed Hat:enterprise_linux:5::client_workstation | before 32:9.7.0-10.P2.el5_8.4 | 32:9.7.0-10.P2.el5_8.4 |
bind97-develRed Hat:enterprise_linux:5::client_workstation | before 32:9.7.0-10.P2.el5_8.4 | 32:9.7.0-10.P2.el5_8.4 |
bind97-libsRed Hat:enterprise_linux:5::client_workstation | before 32:9.7.0-10.P2.el5_8.4 | 32:9.7.0-10.P2.el5_8.4 |
bind97-utilsRed Hat:enterprise_linux:5::client_workstation | before 32:9.7.0-10.P2.el5_8.4 | 32:9.7.0-10.P2.el5_8.4 |
bind97Red Hat:enterprise_linux:5::server | before 32:9.7.0-10.P2.el5_8.4 | 32:9.7.0-10.P2.el5_8.4 |
bind97-chrootRed Hat:enterprise_linux:5::server | before 32:9.7.0-10.P2.el5_8.4 | 32:9.7.0-10.P2.el5_8.4 |
bind97-debuginfoRed Hat:enterprise_linux:5::server | before 32:9.7.0-10.P2.el5_8.4 | 32:9.7.0-10.P2.el5_8.4 |
bind97-develRed Hat:enterprise_linux:5::server | before 32:9.7.0-10.P2.el5_8.4 | 32:9.7.0-10.P2.el5_8.4 |
bind97-libsRed Hat:enterprise_linux:5::server | before 32:9.7.0-10.P2.el5_8.4 | 32:9.7.0-10.P2.el5_8.4 |
bind97-utilsRed Hat:enterprise_linux:5::server | before 32:9.7.0-10.P2.el5_8.4 | 32:9.7.0-10.P2.el5_8.4 |
bindRed Hat:rhel_els:4::as From an advisory covering 2 CVEs | before 20:9.2.4-41.el4 | 20:9.2.4-41.el4 |
bind-chrootRed Hat:rhel_els:4::as From an advisory covering 2 CVEs | before 20:9.2.4-41.el4 | 20:9.2.4-41.el4 |
bind-debuginfoRed Hat:rhel_els:4::as From an advisory covering 2 CVEs | before 20:9.2.4-41.el4 | 20:9.2.4-41.el4 |
bind-develRed Hat:rhel_els:4::as From an advisory covering 2 CVEs | before 20:9.2.4-41.el4 | 20:9.2.4-41.el4 |
bind-libsRed Hat:rhel_els:4::as From an advisory covering 2 CVEs | before 20:9.2.4-41.el4 | 20:9.2.4-41.el4 |
bind-utilsRed Hat:rhel_els:4::as From an advisory covering 2 CVEs | before 20:9.2.4-41.el4 | 20:9.2.4-41.el4 |
bindRed Hat:rhel_els:4::es From an advisory covering 2 CVEs | before 20:9.2.4-41.el4 | 20:9.2.4-41.el4 |
bind-chrootRed Hat:rhel_els:4::es From an advisory covering 2 CVEs | before 20:9.2.4-41.el4 | 20:9.2.4-41.el4 |
bind-debuginfoRed Hat:rhel_els:4::es From an advisory covering 2 CVEs | before 20:9.2.4-41.el4 | 20:9.2.4-41.el4 |
bind-develRed Hat:rhel_els:4::es From an advisory covering 2 CVEs | before 20:9.2.4-41.el4 | 20:9.2.4-41.el4 |
bind-libsRed Hat:rhel_els:4::es From an advisory covering 2 CVEs | before 20:9.2.4-41.el4 | 20:9.2.4-41.el4 |
bind-utilsRed Hat:rhel_els:4::es From an advisory covering 2 CVEs | before 20:9.2.4-41.el4 | 20:9.2.4-41.el4 |
bindopenSUSE:Tumbleweed From an advisory covering 37 CVEs | before 9.10.3P4-21.1 | 9.10.3P4-21.1 |
What each source reports
NVD Score used
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.
- Record
CVE-2012-5166- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE ListNo score
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.
- Record
CVE-2012-5166- Updated
- 2026-11-02
EUVDEUVD-2012-5089No score
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.
- Record
EUVD-2012-5089- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v7pj-79hf-f778No score
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6...
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.
- Record
GHSA-v7pj-79hf-f778- Updated
- 2026-11-02
OSVNo score
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.
- Record
CVE-2012-5166- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-5166No score
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.
- Record
DEBIAN-CVE-2012-5166- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10467-1No score
bind-9.10.3P4-21.1 on GA media
These are all security issues fixed in the bind-9.10.3P4-21.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10467-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0011-2No score
Security update for bind
This update fixes a DoS vulnerability in bind when handling malformed NSEC3-signed zones. CVE-2014-0591 has been assigned to this issue.
Security Issue references:
* CVE-2014-0591
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0591>
- Record
SUSE-SU-2015:0011-2- Updated
- 2026-11-02
OSVSUSE-SU-2015:0480-1No score
Security update for bind
This update fixes a DoS vulnerability in bind when handling malformed NSEC3-signed zones. CVE-2014-0591 has been assigned to this issue.
Security Issue references:
* CVE-2014-0591
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0591>
- Record
SUSE-SU-2015:0480-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
ibm.com/support/docview.wss?uid=isg1IV30365
rhn.redhat.com/errata/RHSA-2012-1363.html
slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.536004
secunia.com/advisories/50909
Show 108 moreShow less
osvdb.org/86118
lists.opensuse.org/opensuse-security-announce/2012-10/msg00013.html
lists.fedoraproject.org/pipermail/package-announce/2012-October/090346.html
isc.org/software/bind/advisories/cve-2012-5166
mandriva.com/security/advisories?name=MDVSA-2012:162
lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
kb.isc.org/article/AA-00801
aix.software.ibm.com/aix/efixes/security/bind9_advisory5.asc
debian.org/security/2012/dsa-2560
h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19706
securityfocus.com/bid/55852
blogs.oracle.com/sunsecurity/entry/cve_2012_5166_denial_of
support.apple.com/kb/HT5880
xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
nvd.nist.gov/vuln/detail/CVE-2012-5166
github.com/advisories/GHSA-v7pj-79hf-f778
security-tracker.debian.org/tracker/CVE-2012-5166
access.redhat.com/errata/RHSA-2012:1363
bugzilla.redhat.com/show_bug.cgi?id=864273
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1363.json
cve.org/CVERecord?id=CVE-2012-5166
suse.com/support/update/announcement/2015/suse-su-20150011-2
bugzilla.suse.com/743758