PT-2018-6129 · Dns-Sync · Dns-Sync

Cristianstaicu · Publicado 2018-06-07 · Atualizado 2019-10-09 · CVE-2017-16100

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: dns-sync versions (affected versions not specified)

Description: The issue concerns an arbitrary command execution vulnerability in the resolve() method of dns-sync. This occurs when untrusted user input is allowed into the resolve() method, enabling command injection.

Recommendations:

• For all affected versions, do not allow untrusted input into dns-sync.resolve().
• As a temporary workaround, consider using an alternative dns resolver until a patch is available.

Exploit

Correção

Command Injection

Code Injection

Enumeração de Fraquezas

CWE-77

CWE-94

Identificadores relacionados

CVE-2017-16100

GHSA-JCW8-R9XM-32C6

Produtos afetados

Dns-Sync

Referências · 12

• 🔥 https://github.com/skoranga/node-dns-sync/issues/5 · Exploit
• https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d))) · Nota
• https://github.com/skoranga/node-dns-sync/issues/1) · Nota
• https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d · Nota
• https://github.com/skoranga/node-dns-sync/issues/1 · Nota
• https://osv.dev/vulnerability/CVE-2017-16100 · Aviso do Fabricante
• https://npmjs.com/advisories/153 · Nota
• https://osv.dev/vulnerability/GHSA-jcw8-r9xm-32c6 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16100 · Nota de Segurança
• https://nodesecurity.io/advisories/523 · Nota
• https://npmjs.com/advisories/523 · Nota
• https://github.com/advisories/GHSA-jcw8-r9xm-32c6 · Nota