From secunia security advisory at $URL: Description A vulnerability has been reported in MaraDNS, which can be exploited by malicious people to conduct spoofing attacks. The vulnerability is caused due to an error within the cache update policy, which does not properly handle revoked domain names. This can be exploited to keep a domain name resolvable after being deleted from registration. The vulnerability is reported in versions prior to 1.3.07.15 and 1.4.12. Solution Update to version 1.3.07.15 and 1.4.12 or upgrade to version 2.x. @maintainer: do you want bump 1.4 or we can directly stabilize 2.x ?
1.4.12 in cvs. please mark stable 1.4.12
Great, thank you. Arches, please test and mark stable: =net-dns/maradns-1.4.12 Target keywords : "amd64 ppc x86"
amd64 stable
Builds and runs fine on x86. Please mark stable for x86.
ppc done
x86 stable
Thanks, everyone. GLSA Vote: no.
CVE-2012-1570 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1570): The resolver in MaraDNS before 1.3.0.7.15 and 1.4.x before 1.4.12 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
GLSA vote: no. Closing noglsa.