PT-2019-6240 · Nlnet+6 · Ldns+6

Pokerfacett · Published 2019-09-24 · Updated 2024-09-09 · CVE-2020-19860

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ldns version 1.7.1

Description The issue is related to a heap out of bounds read in the ldns rr new frm str internal function when verifying a zone file. This allows an attacker to leak information on the heap by constructing a zone file payload, potentially giving access to confidential data.

Recommendations For ldns version 1.7.1, as a temporary workaround, consider restricting the use of the ldns rr new frm str internal function until a patch is available. Avoid using this function with untrusted zone files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2022-1043

ALT-PU-2022-2467

BDU:2022-05877

CVE-2020-19860

DLA-2910-1

OPENSUSE-SU-2022:0675-1

OPENSUSE-SU-2022_0675-1

OPENSUSE-SU-2024:11802-1

ROSA-SA-2024-2476

SUSE-SU-2022:0675-1

SUSE-SU-2022_0675-1

USN-5257-1

USN-5257-2

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Suse

Ubuntu

Ldns

References · 33

• 🔥 https://github.com/NLnetLabs/ldns/issues/50 · Exploit
• https://github.com/NLnetLabs/ldns/commit/15d96206996bea969fbc918eb0a4a346f514b9f3 · Patch
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0675-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2910-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-19861 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0675-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-19860 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-19860 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-19860 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5257-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5257-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5257-2 · Vendor Advisory