PT-2018-4186 · Maradns · Maradns+1

Published 2018-03-20 · Updated 2018-04-18 · CVE-2014-2032

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Deadwood versions prior to 2.3.09 Deadwood versions 3.x prior to 3.2.05 MaraDNS versions prior to 1.4.14 MaraDNS versions 2.x prior to 2.0.09

Description The issue allows remote attackers to cause a denial of service by performing recursive queries against Deadwood, due to missing input validation. This can result in an out-of-bounds read and crash.

Recommendations For Deadwood versions prior to 2.3.09, update to version 2.3.09 or later. For Deadwood versions 3.x prior to 3.2.05, update to version 3.2.05 or later. For MaraDNS versions prior to 1.4.14, update to version 1.4.14 or later. For MaraDNS versions 2.x prior to 2.0.09, update to version 2.0.09 or later.

Fix

Out of bounds Read

RCE

Weakness Enumeration

CWE-125

CWE-20

Related Identifiers

CVE-2014-2032

Affected Products

Deadwood

Maradns

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2014-2032 · Security Note
• http://samiam.org/blog/2014-02-12.html · Vendor Advisory
• http://securityfocus.com/bid/65595 · Note
• http://openwall.com/lists/oss-security/2014/02/19/15 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1066609 · Note
• http://securitytracker.com/id/1029771 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91204 · Note