PT-2019-6251 · Nlnet+6 · Ldns+6
Pokerfacett
·
Published
2019-09-26
·
Updated
2024-09-09
·
CVE-2020-19861
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
ldns version 1.7.1
Description
The issue is related to the function
ldns nsec3 salt data in the ldns library, which is too trusting of the length value obtained from a zone file. This can lead to a heap overflow and information leakage when memcpy is used to copy 0xfe - ldns rdf size(salt rdf) byte data. The vulnerability can be exploited by a remote attacker to gain access to confidential data.Recommendations
For ldns version 1.7.1, consider disabling the
ldns nsec3 salt data function until a patch is available to prevent potential heap overflow and information leakage. Restrict access to sensitive zone files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Suse
Ubuntu
Ldns