The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2017/01/21/1 | Mailing List Patch Third Party Advisory |
| http://www.securityfocus.com/bid/90952 | Third Party Advisory VDB Entry |
| https://bugzilla.redhat.com/show_bug.cgi?id=1332493 | Issue Tracking |
| https://github.com/achernya/hesiod/pull/10 | Issue Tracking Patch Third Party Advisory |
| https://security.gentoo.org/glsa/201805-01 | |
| http://www.openwall.com/lists/oss-security/2017/01/21/1 | Mailing List Patch Third Party Advisory |
| http://www.securityfocus.com/bid/90952 | Third Party Advisory VDB Entry |
| https://bugzilla.redhat.com/show_bug.cgi?id=1332493 | Issue Tracking |
| https://github.com/achernya/hesiod/pull/10 | Issue Tracking Patch Third Party Advisory |
| https://security.gentoo.org/glsa/201805-01 |
Configurations
History
21 Nov 2024, 02:43
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2017/01/21/1 - Mailing List, Patch, Third Party Advisory | |
| References | () http://www.securityfocus.com/bid/90952 - Third Party Advisory, VDB Entry | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=1332493 - Issue Tracking | |
| References | () https://github.com/achernya/hesiod/pull/10 - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://security.gentoo.org/glsa/201805-01 - |
Information
Published : 2017-03-28 14:59
Updated : 2024-11-21 02:43
NVD link : CVE-2016-10152
Mitre link : CVE-2016-10152
CVE.ORG link : CVE-2016-10152
JSON object : View
Products Affected
hesiod_project
- hesiod
CWE
CWE-264
Permissions, Privileges, and Access Controls