CVE-2011-0520 The compress_add_dlabel_points function in dns/Compress.c in MaraDNS 1.4.03, 1.4.05, and probably other versions allows remote attackers to cause a denial of service (segmentation fault) and possibly....
HighCVSS 7.5
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The compress_add_dlabel_points function in dns/Compress.c in MaraDNS 1.4.03, 1.4.05, and probably other versions allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long DNS hostname with a large number of labels, which triggers a heap-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| maradns | = 1.4.03 | No fix listed |
| maradns | = 1.4.05 | No fix listed |
| debian/maradns(Debian:11) | < 1.4.03-1.1 | 1.4.03-1.1 |
References
- bugs.debian.org
- 70630 vdb-entry
- 43027 third-party-advisory vendor-advisory
- 43107 third-party-advisory
- DSA-2196 vendor-advisory
- [oss-security] 20110123 CVE request: MaraDNS DoS via long queries mailing-list
- [oss-security] 20110124 Re: CVE request: MaraDNS DoS via long queries mailing-list
- 45966 vdb-entry
- ADV-2011-0699 vdb-entry
- maradns-compressadddlabelpoints-bo(64885) vdb-entry
- security-tracker.debian.org vendor-advisory