PT-2016-3843 · Apple · Mdnsresponder

Publicado 2016-06-26 · Atualizado 2019-06-19 · CVE-2015-7987

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mDNSResponder versions prior to 625.41.2

Description The issue involves multiple buffer overflows that allow remote attackers to read or write to out-of-bounds memory locations. This can be achieved through various vectors, including the GetValueForIPv4Addr, GetValueForMACAddr, rfc3110 import, or CopyNSEC3ResourceRecord functions.

Recommendations For versions prior to 625.41.2, update to version 625.41.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the functions GetValueForIPv4Addr, GetValueForMACAddr, rfc3110 import, and CopyNSEC3ResourceRecord until a patch is applied.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2015-7987

Produtos afetados

Mdnsresponder

Referências · 6

• http://securitytracker.com/id/1036181 · Nota
• http://kb.cert.org/vuls/id/143335 · Nota
• https://support.apple.com/HT206846 · Aviso do Fabricante
• http://securityfocus.com/bid/91323 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7987 · Nota de Segurança
• http://oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html · Nota