CVE-2007-3409

high-risk
Published 2007-06-26

Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.

Do I need to act?

!
18.0% chance of exploitation in next 30 days
EPSS score — higher than 82% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (5)

Affected Vendors

Net-Dns Debian Canonical

References (50)

Broken Link ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc
Broken Link http://osvdb.org/37054
Broken Link http://rt.cpan.org/Public/Bug/Display.html?id=27285
Broken Link http://secunia.com/advisories/25829
Broken Link http://secunia.com/advisories/26012
Broken Link http://secunia.com/advisories/26014
Broken Link http://secunia.com/advisories/26055
Broken Link http://secunia.com/advisories/26075
Broken Link http://secunia.com/advisories/26211
Broken Link http://secunia.com/advisories/26231
Broken Link http://secunia.com/advisories/26417
Broken Link http://secunia.com/advisories/26543
Broken Link http://secunia.com/advisories/29354
Mailing List http://www.debian.org/security/2008/dsa-1515
Third Party Advisory http://www.gentoo.org/security/en/glsa/glsa-200708-06.xml
Third Party Advisory http://www.mandriva.com/security/advisories?name=MDKSA-2007:146
Release Notes http://www.net-dns.org/docs/Changes.html
Broken Link http://www.novell.com/linux/security/advisories/2007_17_sr.html
Broken Link http://www.redhat.com/support/errata/RHSA-2007-0674.html
Broken Link http://www.securityfocus.com/archive/1/473871/100/0/threaded
and 30 more references
51
/ 100
high-risk
Severity 26/34 · High
Exploitability 13/34 · Low
Exposure 12/34 · Low