GLSA Advocate
Joined: 12 May 2004 Posts: 2663
|
Posted: Wed May 10, 2006 5:26 am Post subject: [ GLSA 200605-10 ] pdnsd: Denial of Service and potential ar |
|
|
Gentoo Linux Security Advisory
Title: pdnsd: Denial of Service and potential arbitrary code execution (GLSA 200605-10)
Severity: high
Exploitable: remote
Date: May 10, 2006
Bug(s): #131341
ID: 200605-10
Synopsis
pdnsd is vulnerable to a buffer overflow that may result in arbitrary code execution.
Background
pdnsd is a proxy DNS server with permanent caching that is designed to cope with unreachable DNS servers.
Affected Packages
Package: net-dns/pdnsd
Vulnerable: < 1.2.4
Unaffected: >= 1.2.4
Architectures: All supported architectures
Description
The pdnsd team has discovered an unspecified buffer overflow vulnerability. The PROTOS DNS Test Suite, by the Oulu University Secure Programming Group (OUSPG), has also revealed a memory leak error within the handling of the QTYPE and QCLASS DNS queries, leading to consumption of large amounts of memory.
Impact
An attacker can craft malicious DNS queries leading to a Denial of Service, and potentially the execution of arbitrary code.
Workaround
There is no known workaround at this time.
Resolution
All pdnsd users should upgrade to the latest version: Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=net-dns/pdnsd-1.2.4-r1" |
References
CVE-2006-2076
CVE-2006-2077 |
|