CVE-2011-5055 MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without properly restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of servi...
MediumCVSS 5.0
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without properly restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted queries with the Recursion Desired (RD) bit set. NOTE: this issue exists because of an incomplete fix for CVE-2012-0024.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/maradns(Debian:11) | < 1.4.09-1 | 1.4.09-1 |
| maradns | = 1.3.07.012 | No fix listed |
| maradns | = 1.4.08 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- [oss-security] 20120103 Re: CVE request: maradns hash table collision cpu dos mailing-list
- [oss-security] 20120103 CVE request: maradns hash table collision cpu dos mailing-list
- samiam.org patch
- bugzilla.redhat.com