PT-2017-13400 · Yadifa · Yadifa

Ca0S + 3 · Publicado 2017-09-20 · Atualizado 2019-10-03 · CVE-2017-14339

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions YADIFA versions prior to 2.2.6

Description The issue is related to the DNS packet parser, which does not check for infinite pointer loops. This allows an attacker to force the server into an infinite loop, resulting in high CPU usage and making the server unresponsive.

Recommendations For versions prior to 2.2.6, update to version 2.2.6 or later to resolve the issue.

Exploit

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2017-14339

DSA-4001-1

Produtos afetados

Yadifa

Referências · 15

• 🔥 https://tarlogic.com/blog/fuzzing-yadifa-dns · Exploit
• https://github.com/yadifa/yadifa/blob/v2.2.6/ChangeLog · Nota
• http://debian.org/security/2017/dsa-4001 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14339 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-4001-1 · Aviso do Fabricante
• https://packages.debian.org/src:yadifa · Nota
• https://cve.org/CVERecord?id=CVE-2017-14339 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2017-14339 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/yadifa · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-14339 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-14339 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-14339 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-4001-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14339 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14339 · Aviso do Fabricante