CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-31137 – MaraDNS Integer Underflow Vulnerability in DNS Packet Decompression
https://notcve.org/view.php?id=CVE-2023-31137
MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination. The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service. One proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len <= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58. • https://github.com/samboy/MaraDNS/blob/08b21ea20d80cedcb74aa8f14979ec7c61846663/dns/Decompress.c#L886 https://github.com/samboy/MaraDNS/commit/bab062bde40b2ae8a91eecd522e84d8b993bab58 https://github.com/samboy/MaraDNS/security/advisories/GHSA-58m7-826v-9c3c https://lists.debian.org/debian-lts-announce/2023/06/msg00019.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3VSMLJX25MXGQ6A7UPOGK7VPUVDESPHL https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NB7 • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-30256
https://notcve.org/view.php?id=CVE-2022-30256
An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for "Ghost" domain names. Se descubrió un problema en MaraDNS Deadwood hasta 3.5.0021 que permite la variante V1 de resolución de nombres de dominio no deseada. Un nombre de dominio revocado aún se puede resolver durante mucho tiempo, incluidos dominios caducados y dominios maliciosos eliminados. • https://lists.debian.org/debian-lts-announce/2023/06/msg00019.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3VSMLJX25MXGQ6A7UPOGK7VPUVDESPHL https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NB7LDZM5AGWC5BHHQHW6CP5OFNBBKFOQ https://maradns.samiam.org https://maradns.samiam.org/security.html#CVE-2022-30256 https://www.debian.org/security/2023/dsa-5441 • CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2014-2031
https://notcve.org/view.php?id=CVE-2014-2031
Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out-of-bounds read and crash) by leveraging permission to perform recursive queries against Deadwood, related to a logic error. Deadwood, en versiones anteriores a la 2.3.09, versiones 3.x anteriores a la 3.2.05; y tal y como se emplea en MaraDNS, en versiones anteriores a la 1.4.14 y en versiones 2.x anteriores a la 2.0.09, permite que atacantes remotos provoquen una denegación de servicio (lectura fuera de límites y cierre inesperado) aprovechando los permisos para realizar consultas recursivas contra Deadwood. Esto se relaciona con un error de lógica. • http://samiam.org/blog/2014-02-12.html http://www.openwall.com/lists/oss-security/2014/02/19/15 http://www.securitytracker.com/id/1029771 https://bugzilla.redhat.com/show_bug.cgi?id=1066609 https://exchange.xforce.ibmcloud.com/vulnerabilities/91203 • CWE-125: Out-of-bounds Read •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2014-2032
https://notcve.org/view.php?id=CVE-2014-2032
Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out-of-bounds read and crash) by leveraging permission to perform recursive queries against Deadwood, related to missing input validation. Deadwood, en versiones anteriores a la 2.3.09, versiones 3.x anteriores a la 3.2.05; y tal y como se emplea en MaraDNS, en versiones anteriores a la 1.4.14 y en versiones 2.x anteriores a la 2.0.09, permite que atacantes remotos provoquen una denegación de servicio (lectura fuera de límites y cierre inesperado) aprovechando los permisos para realizar consultas recursivas contra Deadwood. Esto se relaciona con la falta de validación de entradas. • http://samiam.org/blog/2014-02-12.html http://www.openwall.com/lists/oss-security/2014/02/19/15 http://www.securityfocus.com/bid/65595 http://www.securitytracker.com/id/1029771 https://bugzilla.redhat.com/show_bug.cgi?id=1066609 https://exchange.xforce.ibmcloud.com/vulnerabilities/91204 • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2012-1570
https://notcve.org/view.php?id=CVE-2012-1570
The resolver in MaraDNS before 1.3.0.7.15 and 1.4.x before 1.4.12 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. La resolución en MaraDNS antes de v1.3.0.7.15 y v1.4.x antes de v1.4.12 sobrescribe los nombres de caché del servidor y los valores TTL en los registros NS durante la tramitación de una respuesta a una consulta de registro A, lo que permite a atacantes remotos provocar resolución continua de nombres de dominio revocados a través de un de ataque de "nombres de dominio fantasmas. • http://osvdb.org/80192 http://secunia.com/advisories/48492 http://www.maradns.org/changelog.html http://www.openwall.com/lists/oss-security/2012/03/20/1 http://www.openwall.com/lists/oss-security/2012/03/20/10 http://www.securitytracker.com/id?1026821 https://bugzilla.redhat.com/show_bug.cgi?id=804770 https://exchange.xforce.ibmcloud.com/vulnerabilities/74119 •