VulnerabilityModified

CVE-2009-0858

Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via…

MEDIUM 5.8EPSS 6.28%

Does this matter?

Lower severity and a low EPSS score (6.28%). Track it; it rarely justifies an emergency change on its own.

Description

The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via crafted zone data for this subdomain.

CVSS 2.0: 5.8 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P
EPSS: 6.28% probability · 93th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: d.j.bernstein/djbdns
Source: cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.