The response_addname function in response.c in Daniel J. Bernstein djbdns...
Vulnerability Description
The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via crafted zone data for this subdomain.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-0858
Credits & Attribution
No credits recorded in the NVD database.
References
- http://secunia.com/advisories/35820
- http://www.securityfocus.com/archive/1/501340/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49003
- http://www.securityfocus.com/archive/1/501479/100/0/threaded
- http://securityandthe.net/2009/03/05/security-issue-in-djbdns-confirmed/
- http://www.debian.org/security/2009/dsa-1831
- http://marc.info/?l=djbdns&m=123613000920446&w=2
- http://www.securityfocus.com/bid/33937
- http://www.securityfocus.com/archive/1/501294/100/0/threaded
- http://marc.info/?l=djbdns&m=123554945710038
- http://it.slashdot.org/article.pl?sid=09/03/05/2014249
Affected Vendor
d.j.bernstein
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.