CVE-2009-0858

The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via crafted zone data for this subdomain.

CVSS v2.0

5.8 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P

EPSS

6.28% chance of exploitation in the next 30 days, 93th percentile

Published

2009-03-09

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/32825

References

• CVE Record
• NVD entry

Related

• CVE-2009-0855
• CVE-2009-0863
• CVE-2009-0853
• CVE-2009-0864
• CVE-2009-0852
• CVE-2009-0865