PT-2019-6251 · Nlnet+6 · Ldns+6
Pokerfacett
·
Publicado
2019-09-26
·
Atualizado
2024-09-09
·
CVE-2020-19861
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
ldns version 1.7.1
Description
The issue is related to the function
ldns nsec3 salt data in the ldns library, which is too trusting of the length value obtained from a zone file. This can lead to a heap overflow and information leakage when memcpy is used to copy 0xfe - ldns rdf size(salt rdf) byte data. The vulnerability can be exploited by a remote attacker to gain access to confidential data.Recommendations
For ldns version 1.7.1, consider disabling the
ldns nsec3 salt data function until a patch is available to prevent potential heap overflow and information leakage. Restrict access to sensitive zone files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Debian
Linuxmint
Suse
Ubuntu
Ldns