OESA-2024-2390 dhcp security update

The Dynamic Host Configuration Protocol DHCP is a network management protocol used on UDP/IP networks whereby a DHCP server dynamically assigns an IP address and other network configuration parameters to each device on a network so they can communicate with other IP networks. Security Fixes:...

Avahi 安全漏洞

Avahi is the Avahi open source suite of local service discovery tools for Linux. Avahi suffers from a security vulnerability that stems from the fact that it randomly initializes the DNS transaction ID only once at startup and then increments it sequentially thereafter. It is susceptible to DNS...

Avahi 安全特征问题漏洞

Avahi is the Avahi open source set of local service discovery tools for Linux. A security vulnerability exists in Avahi that stems from a dependency on fixed source ports for wide-area DNS lookups, simplifying the injection of malicious DNS response attacks...

Experts Uncover 70,000 Hijacked Domains in Widespread 'Sitting Ducks' Attack Scheme

Multiple threat actors have been found taking advantage of an attack technique called Sitting Ducks to hijack legitimate domains for using them in phishing attacks and investment fraud schemes for years. The findings come from Infoblox, which said it identified nearly 800,000 vulnerable registere...

CVE-2024-43450

Windows DNS Spoofing Vulnerability...

golang: net: malformed DNS message can cause infinite loop

A flaw was found in the net package of the Go stdlib. When a malformed DNS message is received as a response to a query, the Lookup functions within the net package can get stuck in an infinite loop. This issue can lead to resource exhaustion and denial of service DoS conditions...

golang: net: malformed DNS message can cause infinite loop

A flaw was found in the net package of the Go stdlib. When a malformed DNS message is received as a response to a query, the Lookup functions within the net package can get stuck in an infinite loop. This issue can lead to resource exhaustion and denial of service DoS conditions...

golang: net: malformed DNS message can cause infinite loop

A flaw was found in the net package of the Go stdlib. When a malformed DNS message is received as a response to a query, the Lookup functions within the net package can get stuck in an infinite loop. This issue can lead to resource exhaustion and denial of service DoS conditions...

NETGEAR R8500 安全漏洞

The NETGEAR R8500 is a wireless router from NETGEAR. A buffer overflow vulnerability exists in the NETGEAR R8500 v1.0.2.160, which stems from the ipv6pridns parameter in the ipv6fix.cgi component that fails to correctly validate the length of the incoming data, and can be exploited by a remote...

SUSE CVE-2024-49753

Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost 127.0.0.1. The isHostBlocked...

CLSA-2024-1730480495 bind: Fix of CVE-2023-4408

CVE-2023-4408: speed up parsing of DNS messages with many different names - fix tests...

CyberPanel 安全漏洞

CyberPanel is a web hosting control panel with built-in DNS and email servers by Usman Nasir, an individual developer. CyberPanel has a security vulnerability that originates from getresetstatus in dns/views.py that allows remote attackers to bypass authentication and execute arbitrary commands v...

A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server which also serves protocols other than dnsserver will be restarted after a short delay but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate but many RPC services will not.

...

OESA-2024-2234 unbound security update

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most...

The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases) aka the "DNSBomb" issue.

...

golang: net: malformed DNS message can cause infinite loop

A flaw was found in the net package of the Go stdlib. When a malformed DNS message is received as a response to a query, the Lookup functions within the net package can get stuck in an infinite loop. This issue can lead to resource exhaustion and denial of service DoS conditions...

Malicious code in ws-api-typescript-infra (npm)

The package contains code to exfiltrate local machine information to a remote server over DNS. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 307f2e541390b49f3169786119b7f694fa2a2da04848f23037e9e101c4cefa85 Any computer that has this package installed or running...

Malicious code in botframework-webchat-cldr-data-downloader (npm)

The package contains code to exfiltrate local machine information to a remote server over DNS. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 069cec738fcd016cead066052e66581ac130f721c6454d3079b1d054381031e8 Any computer that has this package installed or running...

Malicious code in descriptiongenerator-typescript-runtime (npm)

The package contains code to exfiltrate local machine information to a remote server over DNS. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01ce8c140437db152bce12a94652fc2dbd5af9a9a2792e41ed7cdea5fe8b02c7 Any computer that has this package installed or running...

Malicious code in ads-api-report-fetcher (npm)

The package contains code to exfiltrate local machine information to a remote server over DNS. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57e20c733e3432bce50d7684946f0b982e3dd599d8a2df2689208afe1237c24d Any computer that has this package installed or running...