CVE-2009-4022

Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed "at the same time as requesting DNSSEC records (DO)," aka Bug 20438.

• ftp://ftp.sco.com/pub/unixware7/714/security/p535243_uw7/p535243b.txt
• http://aix.software.ibm.com/aix/efixes/security/bind9_advisory.asc
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
• http://lists.vmware.com/pipermail/security-announce/2010/000082.html
• http://osvdb.org/60493
• http://secunia.com/advisories/37426Vendor Advisory
• http://secunia.com/advisories/37491Vendor Advisory
• http://secunia.com/advisories/38219Vendor Advisory
• http://secunia.com/advisories/38240Vendor Advisory
• http://secunia.com/advisories/38794Vendor Advisory
• http://secunia.com/advisories/38834Vendor Advisory
• http://secunia.com/advisories/39334Vendor Advisory
• http://secunia.com/advisories/40730Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021660.1-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021798.1-1
• http://support.apple.com/kb/HT5002
• http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0018
• http://www.ibm.com/support/docview.wss?uid=isg1IZ68597
• http://www.ibm.com/support/docview.wss?uid=isg1IZ71667
• http://www.ibm.com/support/docview.wss?uid=isg1IZ71774
• http://www.kb.cert.org/vuls/id/418861US Government Resource
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:304
• http://www.openwall.com/lists/oss-security/2009/11/24/1
• http://www.openwall.com/lists/oss-security/2009/11/24/2
• http://www.openwall.com/lists/oss-security/2009/11/24/8
• http://www.redhat.com/support/errata/RHSA-2009-1620.htmlVendor Advisory
• http://www.securityfocus.com/bid/37118
• http://www.ubuntu.com/usn/USN-888-1
• http://www.vupen.com/english/advisories/2009/3335Vendor Advisory
• http://www.vupen.com/english/advisories/2010/0176Vendor Advisory
• http://www.vupen.com/english/advisories/2010/0528Vendor Advisory
• http://www.vupen.com/english/advisories/2010/0622Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=538744Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54416
• https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488
• https://issues.rpath.com/browse/RPL-3152
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10821
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11745
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7261
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7459
• https://www.isc.org/advisories/CVE-2009-4022v6Vendor Advisory
• https://www.isc.org/advisories/CVE2009-4022Vendor Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01172.html
• https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01188.html
• ftp://ftp.sco.com/pub/unixware7/714/security/p535243_uw7/p535243b.txt
• http://aix.software.ibm.com/aix/efixes/security/bind9_advisory.asc
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
• http://lists.vmware.com/pipermail/security-announce/2010/000082.html
• http://osvdb.org/60493
• http://secunia.com/advisories/37426Vendor Advisory
• http://secunia.com/advisories/37491Vendor Advisory
• http://secunia.com/advisories/38219Vendor Advisory
• http://secunia.com/advisories/38240Vendor Advisory
• http://secunia.com/advisories/38794Vendor Advisory
• http://secunia.com/advisories/38834Vendor Advisory
• http://secunia.com/advisories/39334Vendor Advisory
• http://secunia.com/advisories/40730Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021660.1-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021798.1-1
• http://support.apple.com/kb/HT5002
• http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0018
• http://www.ibm.com/support/docview.wss?uid=isg1IZ68597
• http://www.ibm.com/support/docview.wss?uid=isg1IZ71667
• http://www.ibm.com/support/docview.wss?uid=isg1IZ71774
• http://www.kb.cert.org/vuls/id/418861US Government Resource
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:304
• http://www.openwall.com/lists/oss-security/2009/11/24/1
• http://www.openwall.com/lists/oss-security/2009/11/24/2
• http://www.openwall.com/lists/oss-security/2009/11/24/8
• http://www.redhat.com/support/errata/RHSA-2009-1620.htmlVendor Advisory
• http://www.securityfocus.com/bid/37118
• http://www.ubuntu.com/usn/USN-888-1
• http://www.vupen.com/english/advisories/2009/3335Vendor Advisory
• http://www.vupen.com/english/advisories/2010/0176Vendor Advisory
• http://www.vupen.com/english/advisories/2010/0528Vendor Advisory
• http://www.vupen.com/english/advisories/2010/0622Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=538744Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54416
• https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488
• https://issues.rpath.com/browse/RPL-3152
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10821
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11745
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7261
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7459
• https://www.isc.org/advisories/CVE-2009-4022v6Vendor Advisory
• https://www.isc.org/advisories/CVE2009-4022Vendor Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01172.html
• https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01188.html

Published

Nov 25, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-4016Integer underflow in the clean_string function in irc_string…
• CVE-2009-4017PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict t…
• CVE-2009-4018The proc_open function in ext/standard/proc_open.c in PHP be…
• CVE-2009-4019mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 …
• CVE-2009-4020Stack-based buffer overflow in the hfs subsystem in the Linu…
• CVE-2009-4021The fuse_direct_io function in fs/fuse/file.c in the fuse su…
• CVE-2009-4023Argument injection vulnerability in the sendmail implementat…
• CVE-2009-4024Argument injection vulnerability in the ping function in Pin…
• CVE-2009-4025Argument injection vulnerability in the traceroute function …
• CVE-2009-4026The mac80211 subsystem in the Linux kernel before 2.6.32-rc8…
• CVE-2009-4027Race condition in the mac80211 subsystem in the Linux kernel…
• CVE-2009-4028The vio_verify_callback function in viosslfactories.c in MyS…