PT-2009-3450 · Dj Bernstein · Djbdns

Matthew Dempsky · Publicado 2009-03-09 · Atualizado 2018-10-10 · CVE-2009-0858

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions djbdns versions 1.05 and earlier

Description The issue concerns the response addname function in response.c, which does not properly constrain offsets. This allows remote attackers, who have control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via crafted zone data for this subdomain.

Recommendations For djbdns versions 1.05 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-0858

DSA-1831-1

Produtos afetados

Djbdns

Referências · 16

• 🔥 https://exploit-db.com/exploits/32825 · Exploit
• 🔥 http://securityfocus.com/bid/33937 · Exploit
• http://secunia.com/advisories/35820 · Nota
• http://debian.org/security/2009/dsa-1831 · Aviso do Fabricante
• http://securityfocus.com/archive/1/501294/100/0/threaded · Nota
• http://securityfocus.com/archive/1/501340/100/0/threaded · Nota
• https://security-tracker.debian.org/tracker/CVE-2009-0858 · Aviso do Fabricante
• http://marc.info/?l=djbdns&m=123554945710038 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0858 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-0858 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2009-0858 · Aviso do Fabricante
• http://securityfocus.com/archive/1/501479/100/0/threaded · Nota
• http://marc.info/?l=djbdns&m=123613000920446&w=2 · Nota
• http://it.slashdot.org/article.pl?sid=09/03/05/2014249 · Nota
• http://securityandthe.net/2009/03/05/security-issue-in-djbdns-confirmed · Correção