CVE-2020-10030

{"id": "CVE-2020-10030", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2020-05-19T16:15:10.917", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00052.html", "source": "cve@mitre.org"}, {"url": "https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-03.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMP72NJGKBWR5WEBXAWX5KSLQUDFTG6S/", "source": "cve@mitre.org"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PS4ZN5XGENYNFKX7QIIOUCQQHXE37GJF/", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00052.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-03.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMP72NJGKBWR5WEBXAWX5KSLQUDFTG6S/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PS4ZN5XGENYNFKX7QIIOUCQQHXE37GJF/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker (with enough privileges to change the system's hostname) to cause disclosure of uninitialized memory content via a stack-based out-of-bounds read. It only occurs on systems where gethostname() does not have '\\0' termination of the returned string if the hostname is larger than the supplied buffer. (Linux systems are not affected because the buffer is always large enough. OpenBSD systems are not affected because the returned hostname always has '\\0' termination.) Under some conditions, this issue can lead to the writing of one '\\0' byte out-of-bounds on the stack, causing a denial of service or possibly arbitrary code execution."}, {"lang": "es", "value": "Se ha detectado un problema en PowerDNS Recursor versiones 4.1.0 hasta 4.3.0 en incluy\u00e9ndola. Permite un atacante (con suficientes privilegios para cambiar el nombre de host del sistema) causar una divulgaci\u00f3n del contenido de la memoria no inicializada por medio de una lectura fuera de l\u00edmites en la regi\u00f3n stack de la memoria. Solo se presenta en sistemas donde la funci\u00f3n gethostname() no contiene la terminaci\u00f3n \"\\0\" de la cadena devuelta si el nombre de host es mayor que el b\u00fafer suministrado. (Los sistemas Linux no est\u00e1n afectados porque el b\u00fafer siempre es lo suficientemente grande. Los sistemas OpenBSD no est\u00e1n afectados porque el nombre de host devuelto siempre presenta una terminaci\u00f3n \"\\0\".) Bajo algunas condiciones, este problema puede conllevar a una escritura de un byte '\\ 0' fuera de los l\u00edmites en la pila, causando una denegaci\u00f3n de servicio o posiblemente una ejecuci\u00f3n de c\u00f3digo arbitraria."}], "lastModified": "2024-11-21T04:54:41.057", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CF23533-E208-46EA-AD26-311F66A62358", "versionEndIncluding": "4.3.0", "versionStartIncluding": "4.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}