PT-2023-8932 · Maradns+2 · Maradns+2
Htejeda
·
Published
2023-05-09
·
Updated
2024-03-07
·
CVE-2023-31137
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
MaraDNS versions 3.5.0024 and prior
Description
MaraDNS is open-source software that implements the Domain Name System (DNS). A remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination. The vulnerability exists in the
decomp get rddata function within the Decompress.c file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the rdlength is smaller than rdata, the result is a negative number len = rdlength - total;. This value is then passed to the decomp append bytes function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.Recommendations
To resolve the issue, update to version 3.5.0036 or later, which incorporates the fix for this vulnerability by patching
Decompress.c:887 with a check for if(len <= 0). As a temporary workaround, consider restricting access to the decomp get rddata function within the Decompress.c file to minimize the risk of exploitation.Exploit
Fix
DoS
Integer Underflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Maradns
Ubuntu