Summary: | <net-dns/maradns-1.4.09: Hash collision DoS (CVE-2011-5055,CVE-2012-0024) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | matsuu |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | https://secunia.com/advisories/47425/ | ||
Whiteboard: | B3 [glsa] | ||
Package list: | Runtime testing required: | --- | |
Bug Depends on: | |||
Bug Blocks: | 396397 |
Description
Agostino Sarubbo
![]() 1.4.09 in cvs. please mark stable =net-dns/maradns-1.4.09. Great, thank you. Arches, please test and mark stable: =net-dns/maradns-1.4.09 Target keywords : "amd64 ppc sparc x86" amd64 stable x86 stable sparc keywords dropped ppc done; closing as last arch @security, please vote Thanks, folks. GLSA Vote: yes. CVE-2012-0024 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0024): MaraDNS before 1.3.07.12 and 1.4.x before 1.4.08 computes hash values for DNS data without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted queries with the Recursion Desired (RD) bit set. Vote: yes. Request filed. This issue was resolved and addressed in GLSA 201202-03 at http://security.gentoo.org/glsa/glsa-201202-03.xml by GLSA coordinator Sean Amoss (ackle). CVE-2011-5055 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-5055): MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without properly restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted queries with the Recursion Desired (RD) bit set. NOTE: this issue exists because of an incomplete fix for CVE-2012-0024. (In reply to comment #12) > CVE-2011-5055 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-5055): > MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without > properly restricting the ability to trigger hash collisions predictably, > which allows remote attackers to cause a denial of service (CPU consumption) > by sending many crafted queries with the Recursion Desired (RD) bit set. > NOTE: this issue exists because of an incomplete fix for CVE-2012-0024. CVE-2011-5055 was because of an incomplete fix for CVE-2012-0024; both were fixed in this bug. |