PT-2016-3207 · Mit · Hesiod

Carnil · Publicado 2016-05-03 · Atualizado 2018-10-21 · CVE-2016-10152

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hesiod version 3.2.1

Description The issue is related to the read config file function in lib/hesiod.c, which falls back to the ".athena.mit.edu" default domain when opening the configuration file fails. This allows remote attackers to gain root privileges by poisoning the DNS cache. The exploitation of this issue can lead to a remote attacker gaining root privileges by damaging the integrity of the DNS data through DNS cache manipulation.

Recommendations For Hesiod version 3.2.1, consider disabling the read config file function as a temporary workaround until a patch is available. Restrict access to the DNS cache to minimize the risk of exploitation. Avoid using the default domain ".athena.mit.edu" in the configuration file to prevent potential manipulation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2017-02496

CVE-2016-10152

DLA-796-1

Produtos afetados

Hesiod

Referências · 13

• https://github.com/achernya/hesiod/pull/10 · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10152 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2017/01/21/1 · Correção
• http://securityfocus.com/bid/90952 · Nota
• https://ubuntu.com/security/CVE-2016-10152 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10152 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10152 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-10152 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2016-10152 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-10152 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1332493 · Nota
• https://bdu.fstec.ru/vul/2017-02496 · Nota de Segurança
• https://security.gentoo.org/glsa/201805-01 · Aviso do Fabricante