PT-2018-6129 · Dns-Sync · Dns-Sync

Cristianstaicu · Published 2018-06-07 · Updated 2019-10-09 · CVE-2017-16100

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: dns-sync versions (affected versions not specified)

Description: The issue concerns an arbitrary command execution vulnerability in the resolve() method of dns-sync. This occurs when untrusted user input is allowed into the resolve() method, enabling command injection.

Recommendations:

• For all affected versions, do not allow untrusted input into dns-sync.resolve().
• As a temporary workaround, consider using an alternative dns resolver until a patch is available.

Exploit

Fix

Command Injection

Code Injection

Weakness Enumeration

CWE-77

CWE-94

Related Identifiers

CVE-2017-16100

GHSA-JCW8-R9XM-32C6

Affected Products

Dns-Sync

References · 12

• 🔥 https://github.com/skoranga/node-dns-sync/issues/5 · Exploit
• https://osv.dev/vulnerability/CVE-2017-16100 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jcw8-r9xm-32c6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16100 · Security Note
• https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d))) · Note
• https://github.com/skoranga/node-dns-sync/issues/1) · Note
• https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d · Note
• https://github.com/skoranga/node-dns-sync/issues/1 · Note
• https://npmjs.com/advisories/153 · Note
• https://nodesecurity.io/advisories/523 · Note
• https://npmjs.com/advisories/523 · Note
• https://github.com/advisories/GHSA-jcw8-r9xm-32c6 · Note