PT-2016-3843 · Apple · Mdnsresponder

Published 2016-06-26 · Updated 2019-06-19 · CVE-2015-7987

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mDNSResponder versions prior to 625.41.2

Description The issue involves multiple buffer overflows that allow remote attackers to read or write to out-of-bounds memory locations. This can be achieved through various vectors, including the GetValueForIPv4Addr, GetValueForMACAddr, rfc3110 import, or CopyNSEC3ResourceRecord functions.

Recommendations For versions prior to 625.41.2, update to version 625.41.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the functions GetValueForIPv4Addr, GetValueForMACAddr, rfc3110 import, and CopyNSEC3ResourceRecord until a patch is applied.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2015-7987

Affected Products

Mdnsresponder

References · 6

• https://support.apple.com/HT206846 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7987 · Security Note
• http://securitytracker.com/id/1036181 · Note
• http://kb.cert.org/vuls/id/143335 · Note
• http://securityfocus.com/bid/91323 · Note
• http://oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html · Note