CVE-2002-0684
Buffer overflow in DNS resolver functions that perform lookup of network names and addresses, as used in BIND 4.9.8 and ported to glibc 2.2.5 and earlier, allows remote malicious DNS servers to execute arbitrary code through a subroutine used by…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.86%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Buffer overflow in DNS resolver functions that perform lookup of network names and addresses, as used in BIND 4.9.8 and ported to glibc 2.2.5 and earlier, allows remote malicious DNS servers to execute arbitrary code through a subroutine used by functions such as getnetbyname and getnetbyaddr.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 5.86% probability · 93th percentile
- CISA KEV
- Not listed
- Affected
- gnu/glibc · isc/bind
- Source
- cve@mitre.org
References
- http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000507
- http://marc.info/?l=bugtraq&m=102581482511612&w=2
- http://rhn.redhat.com/errata/RHSA-2002-139.htmlPatch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/542971US Government Resource
- http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-050.php
- http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000507
- http://marc.info/?l=bugtraq&m=102581482511612&w=2
- http://rhn.redhat.com/errata/RHSA-2002-139.htmlPatch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/542971US Government Resource
- http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-050.php
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.