SUSE-SU-2018:0263-1 Security update for libevent

This update for libevent fixes the following issues: - CVE-2016-10195: DNS remote stack overread vulnerability bsc1022917 - CVE-2016-10196: stack/buffer overflow in evutilparsesockaddrport bsc1022918 backport for 2.0.21 - CVE-2016-10197: out-of-bounds read in searchmakenew bsc1022919...

SUSE-SU-2018:0200-1 Security update for libevent

This update for libevent fixes the following security issues: - CVE-2016-10195: DNS remote stack overread vulnerability bsc1022917 - CVE-2016-10196: stack/buffer overflow in evutilparsesockaddrport bsc1022918 - CVE-2016-10197: out-of-bounds read in searchmakenew bsc1022919...

CentOS Update for bind CESA-2018:0101 centos6

Check the version of bind SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882832";...

Microsoft Skypexspaces - DNS Squatting Web Vulnerability

Document Title: =============== Microsoft Skypexspaces - DNS Squatting Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2112 Release Date: ============= 2018-01-12 Vulnerability Laboratory ID VL-ID: ====================================...

Fierce Buffer Overflow Vulnerability

Exploit for linux platform in category local exploits Exploit Title: Fierce Buffer Overflow Exploit Author : Persian Hack Team Discovered by: Mojtaba MobhaM MojtabaKazemi Vendor HomePage: http://www.ha.ckers.org/fierce/ Version : 0.9.9 - Beta Tested on: Kali Description: Fierce is a...

Heap overflow

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service crash or execute arbitrary code via a crafted IPv6 router advertisement request...

Code injection

In systemd through 233, certain sizes passed to dnspacketnew in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a response with a specially crafted TCP payload to trick systemd-resolved into allocating a buffer that's too small, and...

Race condition

A vulnerability in the DNS input packet processor for Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause the DNS process to momentarily restart, which could lead to a partial denial of service DoS condition on the affected system. The vulnerability is due to...

Design/Logic Flaw

A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload or corrupt the information present in the device's local DNS cache. The vulnerability is due to a flaw in handling crafted DNS response messages. An attacker...

CVE-2017-6607

A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload or corrupt the information present in the device's local DNS cache. The vulnerability is due to a flaw in handling crafted DNS response messages. An attacker...

CVE-2016-2224

The decodedotted function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service infinite loop via vectors involving compressed items in a reply...

CVE-2016-6171

Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service memory exhaustion and slave server crash via a large zone transfer for 1 DDNS, 2 AXFR, or 3 IXFR...

CVE-2016-6171

Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service memory exhaustion and slave server crash via a large zone transfer for 1 DDNS, 2 AXFR, or 3 IXFR...

I got emails - G Suite Vulnerability

After recent finding about Uber and SendGrid bug, I decided to check other third party applications that were also used for similar cases. During the investigation, some third party applications were found to be vulnerable including G Suite. The initial research of this vulnerability started when...

Through AWS, Google Cloud and Digital Ocean DNS vulnerability take over nearly 12 million domain names-bug warning-the black bar safety net

Shortly before, I was at cloud hosting provider Digital Ocean domain into the system found a security vulnerability, an attacker or may exploit this vulnerability to take over two million of the plurality of domain names in the report of the transfer gate on. If you have not read this report whil...

The Orphaned Internet – Taking Over 120K Domains via a DNS Vulnerability in AWS, Google Cloud, Rackspace and Digital Ocean

Recently, I found that Digital Ocean suffered from a security vulnerability in their domain import system which allowed for the takeover of 20K domain names. If you haven’t given that post a read I recommend doing so before going through this write up. Originally I had assumed that this issue was...

The Orphaned Internet – Taking Over 120K Domains via a DNS Vulnerability in AWS, Google Cloud, Rackspace and Digital Ocean

Recently, I found that Digital Ocean suffered from a security vulnerability in their domain import system which allowed for the takeover of 20K domain names. If you haven't given that post a read I recommend doing so before going through this write up. Originally I had assumed that this issue was...

bind security update

CentOS Errata and Security Advisory CESA-2016:2615 An update for bind is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

SUSE-SU-2016:2156-1 Security update for glibc

This update for glibc fixes the following issues: - Drop old fix that could break services that start before IPv6 is up. bsc931399 - Do not copy dname field of struct dirent. CVE-2016-1234, bsc969727 - Fix memory leak in nssdnsgethostbyname4r. bsc973010 - Relocate DSOs in dependency order, fixing...

Glibc DNS Resolver Vulnerability

A vulnerability in the GNU libc glibc DNS resolver allows remote code execution CVE-2015-7547. However, this issue can be exploited only from a DNS server that is under the control of an attacker. Ref 91886. This glibc issue is only exploitable by an attacker controlling the DNS server configured...