NVD

Id
48173  
Name
CVE-2009-0858  
Description
The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via crafted zone data for this subdomain.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-03-09  
Modified Date
2009-03-10  
Seq
2009-0858  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
242085 48173 CVE-2009-0858 http://it.slashdot.org/article.pl?sid=09/03/05/2014249  View
242086 48173 CVE-2009-0858 [dns] 20090225 djbdns misformats some long response packets; patch and example  View
242087 48173 CVE-2009-0858 [dns] 20090304 djbdns<=1.05 lets AXFRed subdomains overwrite domains  View
242088 48173 CVE-2009-0858 http://securityandthe.net/2009/03/05/security-issue-in-djbdns-confirmed/  View
242089 48173 CVE-2009-0858 DSA-1831  View
242090 48173 CVE-2009-0858 20090226 djbdns misformats some long response packets; patch and example attack  View
242091 48173 CVE-2009-0858 20090228 Re: djbdns misformats some long response packets; patch and example attack  View
242092 48173 CVE-2009-0858 20090305 Re: djbdns misformats some long response packets; patch and example attack  View
242093 48173 CVE-2009-0858 33937  View
242094 48173 CVE-2009-0858 djbdns-response-packet-spoofing(49003)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40885 JVNDB-2009-001891 Daniel J. Bernstein djbdns における DNS レスポンスに任意のレコードを登録される脆弱性 Daniel J. Bernstein djbdns の response_addname 関数には、要求された様式の補正を強制しないため、DNS レスポンスに任意のレコードを登録される脆弱性が存在します。 CVE-2009-0858 38289 CVE-2009-0858 48173 5.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001891.html 2009-03-09 2009-08-18 View