PT-2007-1039 · Net+1 · Net::Dns+1
Publicado
2007-06-25
·
Atualizado
2018-10-16
·
CVE-2007-3377
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions:
Net::DNS versions prior to 0.60
Description:
The issue concerns multiple vulnerabilities in the libnet-dns-perl package, which can lead to disruption of protected information availability. These vulnerabilities can be exploited remotely. Specifically, the Header.pm module in Net::DNS before version 0.60 generates predictable sequence IDs and can reuse the same starting ID for all child processes of a forking server. This allows remote attackers to spoof DNS responses.
Recommendations:
For versions prior to 0.60, update to version 0.60 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable
Header.pm module to minimize the risk of exploitation. Avoid using the predictable sequence IDs in the affected DNS responses until the issue is resolved.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Net::Dns
Red Hat