CVE-2009-0858
- State
- Published
- Severity
- Not scored
- Published
- Mar 9, 2009
- Updated
- Aug 7, 2024
- Reserved
- Mar 9, 2009
Description
The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via crafted zone data for this subdomain.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 35820third-party-advisory
- 20090228 Re: djbdns misformats some long response packets; patch and example attackmailing-list
- djbdns-response-packet-spoofing(49003)vdb-entry
- 20090305 Re: djbdns misformats some long response packets; patch and example attackmailing-list
- http://securityandthe.net/2009/03/05/security-issue-in-djbdns-confirmed/
- DSA-1831vendor-advisory
- [dns] 20090304 djbdns<=1.05 lets AXFRed subdomains overwrite domainsmailing-list
- 33937vdb-entry
- 20090226 djbdns misformats some long response packets; patch and example attackmailing-list
- [dns] 20090225 djbdns misformats some long response packets; patch and examplemailing-list
- http://it.slashdot.org/article.pl?sid=09/03/05/2014249
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.