PT-2007-3695 · Mydns · Mydns

Published 2007-04-30 · Updated 2017-07-29 · CVE-2007-2362

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MyDNS version 1.1.0

Description The issue involves multiple buffer overflows that can be exploited by remote attackers. This can lead to a denial of service, causing the daemon to crash, and potentially allow the execution of arbitrary code. The buffer overflows occur in the update.c file, with one being heap-based and the other being an off-by-one stack-based buffer overflow.

Recommendations For MyDNS version 1.1.0, consider disabling the update functionality until a patch is available to prevent potential exploitation. Restrict access to the update.c file to minimize the risk of a denial of service or code execution.

Exploit

Fix

Related Identifiers

CVE-2007-2362

DSA-1434-1

DTSA-36-1

Affected Products

Mydns

References · 14

• 🔥 https://exploit-db.com/exploits/3807 · Exploit
• 🔥 http://digit-labs.org/files/exploits/mydns-rr-smash.c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2362 · Security Note
• http://debian.org/security/2007/dsa-1434 · Vendor Advisory
• http://secunia.com/advisories/25007 · Vendor Advisory
• http://securityreason.com/securityalert/2658 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33933 · Note
• http://digit-labs.org/files/patches/mydns-update.c.diff · Note
• http://osvdb.org/35439 · Note
• http://osvdb.org/35438 · Note
• http://securityfocus.com/bid/23694 · Note
• http://secunia.com/advisories/28086 · Note
• http://vupen.com/english/advisories/2007/1561 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/054024.html · Note