Vulnerability Name:

CVE-2009-0858

Assigned:2009-02-26
Published:2009-02-26
Updated:2017-08-16
Summary:The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via crafted zone data for this subdomain.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P)
4.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P/E:U/RL:OF/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.5 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-20
References:Source: MISC
Type: UNKNOWN
http://it.slashdot.org/article.pl?sid=09/03/05/2014249

Source: MLIST
Type: UNKNOWN
[dns] 20090225 djbdns misformats some long response packets; patch and example

Source: MLIST
Type: UNKNOWN
[dns] 20090304 djbdns<=1.05 lets AXFRed subdomains overwrite domains

Source: MISC
Type: PATCH
http://securityandthe.net/2009/03/05/security-issue-in-djbdns-confirmed/

Source: DEBIAN
Type: UNKNOWN
DSA-1831

Source: BUGTRAQ
Type: UNKNOWN
20090226 djbdns misformats some long response packets; patch and example attack

Source: BUGTRAQ
Type: UNKNOWN
20090228 Re: djbdns misformats some long response packets; patch and example attack

Source: BUGTRAQ
Type: UNKNOWN
20090305 Re: djbdns misformats some long response packets; patch and example attack

Source: BID
Type: UNKNOWN
33937

Source: XF
Type: UNKNOWN
djbdns-response-packet-spoofing(49003)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:d.j.bernstein:djbdns:1.05:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:7951
    P
    DSA-1831 djbdns -- programming error
    2015-02-23
    oval:org.mitre.oval:def:13695
    P
    DSA-1831-1 djbdns -- programming error
    2014-06-23
    oval:org.debian:def:1831
    V
    programming error
    2009-07-13
    BACK
    d.j.bernstein djbdns 1.05