PT-2017-18915 · Dnstracer+2 · Dnstracer+2

J0Lama · Published 2017-06-05 · Updated 2022-05-23 · CVE-2017-9430

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dnstracer versions prior to 1.9

Description The issue is a stack-based buffer overflow that can cause a denial of service, resulting in an application crash, or possibly have other unspecified impacts. This occurs when a command line with a long name argument is mishandled in a strcpy call for argv[0]. A potential threat model involves a web application that launches dnstracer with an untrusted name string.

Recommendations For versions prior to 1.9, consider restricting the use of dnstracer with untrusted input to minimize the risk of exploitation. As a temporary workaround, limit the length of command line arguments passed to dnstracer until a fix is available.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2020-3523

ALT-PU-2020-3531

ALT-PU-2022-1923

CVE-2017-9430

Affected Products

Alt Linux

Debian

Dnstracer

References · 11

• 🔥 https://exploit-db.com/exploits/42115 · Exploit
• 🔥 https://exploit-db.com/exploits/42424 · Exploit
• https://ubuntu.com/security/CVE-2017-9430 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-9430 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-9430 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-9430 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-9430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9430 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-9430 · Vendor Advisory
• https://cxsecurity.com/issue/WLB-2017060030 · Note
• https://packetstormsecurity.com/files/142799/DNSTracer-1.8.1-Buffer-Overflow.html · Note