PT-2020-8506 · Adns+2 · Adns+2

Published

2020-06-12

·

Updated

2023-01-27

·

CVE-2017-9108

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions: adns versions prior to 1.5.2
Description: An issue was discovered in adns where adnshost mishandles a missing final newline on a stdin read. This can cause adnshost to read and process one byte beyond the buffer, potentially crashing or leaking the value of that byte. The issue arises because used is incremented according to r later, but it is incorrectly incremented along with setting r. Instead, the code should behave as the read() function would.
Recommendations: For versions prior to 1.5.2, update to version 1.5.2 or later to resolve the issue. As a temporary workaround, consider modifying the adnshost code to correctly handle the missing final newline on stdin reads, ensuring that used is not incremented prematurely.

Fix

Buffer Overflow

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2020-2177
ALT-PU-2020-2191
CVE-2017-9108
OPENSUSE-SU-2020:0827-1
OPENSUSE-SU-2020_0827-1
OPENSUSE-SU-2024:10612-1
SUSE-SU-2020:14399-1
SUSE-SU-2020:1612-1
SUSE-SU-2020_1612-1

Affected Products

Alt Linux
Suse
Adns