BIND -- multiple vulnerabilities

ISC reports: A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other...

UBUNTU-CVE-2017-3137

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND...

Udemy: Subdomain Takeover at Landing.udemy.com

Target: Landing.udemy.com Details: The target subdomain points to unbounce.com service, via a DNS CNAME record. As a result of this, an attacker could potentially initiate a subdomain takeover by registering the subdomain on unbounce.com. Additionally, Unbounce is a custom 404-page hosting servic...

Informatica: [wave.informatica.com]- Subdomain missconfiguration

One of your subdomain https://wave.informatica.com has a CNAME record that resolved to ghs.google.com and shows 404 error when navigating to subdomain. You should remove CNAME entry for that subdomain pointing towards ghs.google.com. Although I couldnt verify the domain ownership process to fully...

HackerOne: Subdomain takeover at info.hacker.one

Summary: Hi team,i've been able to takeover subdomain at info.hacker.one, the CNAME entry in the subdomain is pointing to an external page service app.unbounce.com. Actual Dns Entry: F156764 Steps To Reproduce 1 I have claimed the domain and placed a page for PoC validation located under: Go to -...

Automattic: cloudup Subdomain Takeover That resolves to Desk.com ( CNAME cloudup.desk.com )

Hi, While Looking On The CloudUp Website I found That One of The Subdomain of CloudUp HELP was Hosted on Desk and I think tHe Desk Account of Cloudup was Expired or Canceled by any cause So I have Checked The Site for its CNAME and The CNAME was Resolving to CNAME http://cloudup.desk.com So I Tri...

New Relic: Sub domain issues.

hello there , While performing a DNS enum. on the website , I found 3 domains which return an error , http://de.newrelic.com/ || http://www.samdns.com/lookup/cname/www.newrelic.sl.smartling.com/ http://jp.newrelic.com/ || http://www.samdns.com/lookup/cname/de.newrelic.com/...

Ubiquiti Inc.: Subdomain Takeover (moderator.ubnt.com)

Hello Team This report is same as 179110 One of your subdomain http://moderator.ubnt.com is pointing towards 216.58.203.243 moderator.ubnt.com 216.58.203.243 ghs.google.com 216.58.203.243 ghs.l.google.com F134183 And it is unclaimed When I open it it is showing F134184 Impact :- An attacker can...

Enter: [CRITICAL]-Taking over entire subdomain of romit.io

Hi, During recon, I found out that blog.romit.io was not mapped with wordpress.com and the domain was returning back error like this domain has not been mapped with wordpress.com, to map it please login into wordpres.com. So, I quickly created an account on wordpress.com and mapped blog.romit.io ...

WebSummit: Subdomain take over signup.websummit

Subdomain take over Hi, You have a subdomain aka signup.websummit.net that point to a third party service hosted on Heroku: wsv1.herokuapp.com. The nslookup command shows the DNS configuration. $ nslookup signup.websummit.net 8.8.8.8 Server: 8.8.8.8 Address: 8.8.8.853 Non-authoritative answer:...

Snapchat: Subdomain takeover of blog.snapchat.com

Overview The ANAME for blog.snapchat.com, which redirects to snapchat-blog.com, was pointing to tumblr for Snapchat's blog. This blog had been expired or had removed the CNAME claim. Adding "snapchat-blog.com" to the custom domain setting on tumblr allowed takeover of this subdomain. Repro Steps ...

Boozt Fashion AB: Potential Subdomain Takeover Possible

Issue Description The researcher identified that the affected url points to sendgrid.net, via a DNS CNAME record. As a result of this an attacker could potentially initate a subdomain take over by registering the subdomain sendgrid.boozt.com on sendgrid and consiquently leverage this for further...

USN-3009-1: Dnsmasq vulnerability

Edwin Török discovered that Dnsmasq incorrectly handled certain CNAME responses. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a denial of service...

USN-3009-1 dnsmasq vulnerability

Edwin Török discovered that Dnsmasq incorrectly handled certain CNAME responses. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a denial of service...

Slack: [Screenhero] Subdomain takeover

Hi, I found out some neglected DNS records that can be exploited to takedown the subdomain of Slack's acquisition feedback.screenhero.com The security issue is that you have CNAME record that points feedback.screenhero.com to a screenhero.uservoice.com, but the problem is that the service is...

Fedora 23 : prosody-0.9.9-2.fc23 (2016-38e48069f8)

Prosody 0.9.9 ============= A summary of changes: Security fixes -------------- Fix path traversal vulnerability in modhttpfiles CVE-2016-1231 Fix use of weak PRNG in generation of dialback secrets CVE-2016-1232 Bugs ---- Improve handling of CNAME records in DNS Fix traceback when deleting a user...

CVE-2016-0747

The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service worker process resource consumption via vectors related to arbitrary name resolution...

CVE-2016-0746

Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service worker process crash or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing...

CVE-2016-0746

CVE-2016-0746 is a use-after-free in nginx’s resolver when processing DNS CNAME responses. The issue affects nginx versions before 1.8.1 and 1.9.x before 1.9.10; exploitation could crash worker processes or yield other unspecified impacts. Remediation per connected docs: upgrade to non‑vulnerable...

Use-after-free during CNAME response processing in resolver

Use-after-free during CNAME response processing in resolver Severity: medium CVE-2016-0746 Not vulnerable: 1.9.10+, 1.8.1+ Vulnerable: 0.6.18-1.9.9...