PT-2017-18915 · Dnstracer+2 · Dnstracer+2

J0Lama · Publicado 2017-06-05 · Atualizado 2022-05-23 · CVE-2017-9430

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dnstracer versions prior to 1.9

Description The issue is a stack-based buffer overflow that can cause a denial of service, resulting in an application crash, or possibly have other unspecified impacts. This occurs when a command line with a long name argument is mishandled in a strcpy call for argv[0]. A potential threat model involves a web application that launches dnstracer with an untrusted name string.

Recommendations For versions prior to 1.9, consider restricting the use of dnstracer with untrusted input to minimize the risk of exploitation. As a temporary workaround, limit the length of command line arguments passed to dnstracer until a fix is available.

Exploit

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2020-3523

ALT-PU-2020-3531

ALT-PU-2022-1923

CVE-2017-9430

Produtos afetados

Alt Linux

Debian

Dnstracer

Referências · 11

• 🔥 https://exploit-db.com/exploits/42115 · Exploit
• 🔥 https://exploit-db.com/exploits/42424 · Exploit
• https://cxsecurity.com/issue/WLB-2017060030 · Nota
• https://ubuntu.com/security/CVE-2017-9430 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-9430 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-9430 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2017-9430 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-9430 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9430 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-9430 · Aviso do Fabricante
• https://packetstormsecurity.com/files/142799/DNSTracer-1.8.1-Buffer-Overflow.html · Nota