CVE-2009-0858

The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via crafted zone data for this subdomain.

CVSS v2.0 NVD

5.8 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P

EPSS

6.28% chance of exploitation in the next 30 days, 94th percentile

Published

2009-03-09

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/32825

Security advisories

• http://securityandthe.net/2009/03/05/security-issue-in-djbdns-confirmed
• http://www.securityfocus.com/bid/33937

References

• CVE Record
• NVD entry