ISC BIND named contains a flaw related to the allowing of queries. If the 'allow-query' ACL is not set properly in the zone statement, it does not check the 'view' or 'global' options before defaulting to allowing queries. This issue may allow a remote attacker to bypass query restrictions.

Upgrade to version 9.7.2-P3 or higher, as it has been reported to fix this vulnerability. It is also possible to temporarily work around the flaw by implementing the following workaround: Put the allow-query ACL in each zone statement.

• Security Tracker: 1024817
• CVE ID: 2010-3615 (see also: NVD)
• Secunia Advisory ID: 42458 42474 42671 49353
• Bugtraq ID: 45134
• CERT VU: 510208
• VUPEN Advisory: ADV-2010-3102
• Vendor Specific News/Changelog Entry: http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051963.html
  http://www.gentoo.org/security/en/glsa/glsa-201206-01.xml
  http://www.isc.org/announcement/guidance-regarding-dec-1st-2010-security-advisories
  http://www.isc.org/software/bind/advisories/cve-2010-3615
• Vendor Specific Advisory URL: http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.622190

• Not Available