CVE-2011-5055
MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without properly restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted queries…
Does this matter?
Lower severity and a low EPSS score (1.45%). Track it; it rarely justifies an emergency change on its own.
Description
MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without properly restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted queries with the Recursion Desired (RD) bit set. NOTE: this issue exists because of an incomplete fix for CVE-2012-0024.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 1.45% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- maradns/maradns
- Source
- cve@mitre.org
References
- http://openwall.com/lists/oss-security/2012/01/03/13
- http://openwall.com/lists/oss-security/2012/01/03/6
- http://samiam.org/blog/20111230.htmlPatch
- https://bugzilla.redhat.com/show_bug.cgi?id=771428
- http://openwall.com/lists/oss-security/2012/01/03/13
- http://openwall.com/lists/oss-security/2012/01/03/6
- http://samiam.org/blog/20111230.htmlPatch
- https://bugzilla.redhat.com/show_bug.cgi?id=771428
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.