PT-2018-5778 · Miek Gieben · Miekg-Dns

Miekg · Published 2018-01-29 · Updated 2021-06-29 · CVE-2017-15133

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: miekg-dns versions prior to 1.0.4

Description: A denial of service flaw allows a remote attacker to block the DNS server from accepting new connections by using carefully timed TCP packets or by opening a connection and leaving it idle. This prevents the server from accepting other connections until the idle connection is closed.

Recommendations: For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the DNS server to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2017-15133

GHSA-P55X-7X9V-Q8M4

GO-2020-0006

Affected Products

Miekg-Dns

References · 14

• https://cve.org/CVERecord?id=CVE-2017-15133 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-15133 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2020-0006 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p55x-7x9v-q8m4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15133 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15133 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15133 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15133 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15133 · Vendor Advisory
• https://github.com/miekg/dns/issues/627 · Note
• https://github.com/miekg/dns/commit/43913f2f4fbd7dcff930b8a809e709591e4dd79e · Note
• https://github.com/miekg/dns/pull/631 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1538763 · Note
• https://pkg.go.dev/vuln/GO-2020-0006 · Note