Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2007-0674 advisory.

    [0.31-4.el3]
     - Resolves: rhbz#245616
     - Backport patch to fix dn_expand looping issue
     - Backport patch to randomize ID field
     - Also allow disabling of online tests

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way Net::DNS generated the ID field in a DNS query. This predictable ID field could be used by a remote attacker to return invalid DNS data. (CVE-2007-3377)

A denial of service flaw was found in the way Net::DNS parsed certain DNS requests. A malformed response to a DNS request could cause the application using Net::DNS to crash or stop responding.
(CVE-2007-3409)

perl-Net-DNS uses sequential IDs for DNS lookups which could cause problems with some programs like spamassassin. It potentially also simplifies DNS spoofing attacks against perl-Net-DNS. (CVE-2007-3377)

Additionally, malformed compressed DNS packets could trigger an endless loop in perl-Net-DNS. (CVE-2007-3409)

Several remote vulnerabilities have been discovered in libnet-dns-perl. The Common Vulnerabilities and Exposures project identifies the following problems :

It was discovered that libnet-dns-perl generates very weak transaction IDs when sending queries (CVE-2007-3377 ). This update switches transaction ID generation to the Perl random generator, making prediction attacks more difficult.

Compression loops in domain names resulted in an infinite loop in the domain name expander written in Perl (CVE-2007-3409 ). The Debian package uses an expander written in C by default, but this vulnerability has been addressed nevertheless.

Decoding malformed A records could lead to a crash (via an uncaught Perl exception) of certain applications using libnet-dns-perl (CVE-2007-6341 ).

perl-Net-DNS used sequential IDs for DNS lookups which could cause problem with some programs like spamassassin. It potentially also simplified DNS spoofing attacks against perl-Net-DNS. (CVE-2007-3377)

Additionally malformed compressed DNS packets could trigger an endless loop in perl-Net-DNS. (CVE-2007-3409)

Peter Johannes Holzer discovered that the Net::DNS Perl module had predictable sequence numbers. This could allow remote attackers to carry out DNS spoofing, leading to possible man-in-the-middle attacks.
(CVE-2007-3377)

Steffen Ullrich discovered that the Net::DNS Perl module did not correctly detect recursive compressed responses. A remote attacker could send a specially crafted packet, causing applications using Net::DNS to crash or monopolize CPU resources, leading to a denial of service. (CVE-2007-3409).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

perl-Net-DNS used sequential IDs for DNS lookups which could cause problem with some programs like spamassassin. It potentially also simplified DNS spoofing attacks against perl-Net-DNS (CVE-2007-3377).

Additionally malformed compressed DNS packets could trigger an endless loop in perl-Net-DNS (CVE-2007-3409).

The remote host is affected by the vulnerability described in GLSA-200708-06 (Net::DNS: Multiple vulnerabilities)

    hjp discovered an error when handling DNS query IDs which make them     partially predictable. Steffen Ullrich discovered an error in the     dn_expand() function which could lead to an endless loop.
  Impact :

    A remote attacker could send a specially crafted DNS request to the     server which could result in a Denial of Service with an infinite     recursion, or perform a cache poisoning attack.
  Workaround :

    There is no known workaround at this time.

A Secunia Advisory reports :

An error exists in the handling of DNS queries where IDs are incremented with a fixed value and are additionally used for child processes in a forking server. This can be exploited to poison the DNS cache of an application using the module if a valid ID is guessed.

An error in the PP implementation within the 'dn_expand()' function can be exploited to cause a stack overflow due to an endless loop via a specially crafted DNS packet.

Updated perl-Net-DNS packages that correct two security issues are now available for Red Hat Enterprise Linux 3 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Net::DNS is a collection of Perl modules that act as a Domain Name System (DNS) resolver.

A flaw was found in the way Net::DNS generated the ID field in a DNS query. This predictable ID field could be used by a remote attacker to return invalid DNS data. (CVE-2007-3377)

A denial of service flaw was found in the way Net::DNS parsed certain DNS requests. A malformed response to a DNS request could cause the application using Net::DNS to crash or stop responding.
(CVE-2007-3409)

Users of Net::DNS should upgrade to these updated packages, which contain backported patches to correct these issues.

A flaw was discovered in the perl Net::DNS module in the way it generated the ID field in a DNS query. Because it is so predictable, a remote attacker could exploit this to return invalid DNS data (CVE-2007-3377).

A denial of service vulnerability was found in how Net::DNS parsed certain DNS requests. A malformed response to a DNS request could cause the application using Net::DNS to crash or stop responding (CVE-2007-3409).

The updated packages have been patched to prevent these issues.

ID	Name	Product	Family	Severity
67541	Oracle Linux 5 : Moderate: / perl-Net-DNS (ELSA-2007-0674)	Nessus	Oracle Linux Local Security Checks	high
60223	Scientific Linux Security Update : perl-Net-DNS on SL3.0.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41146	SuSE9 Security Update : perl-Net-DNS (YOU Patch Number 11702)	Nessus	SuSE Local Security Checks	medium
31426	Debian DSA-1515-1 : libnet-dns-perl - several vulnerabilities	Nessus	Debian Local Security Checks	medium
29551	SuSE 10 Security Update : perl-Net-DNS (ZYPP Patch Number 4046)	Nessus	SuSE Local Security Checks	medium
28084	Ubuntu 6.06 LTS / 6.10 : libnet-dns-perl vulnerabilities (USN-483-1)	Nessus	Ubuntu Local Security Checks	medium
27387	openSUSE 10 Security Update : perl-Net-DNS (perl-Net-DNS-3961)	Nessus	SuSE Local Security Checks	medium
25871	GLSA-200708-06 : Net::DNS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
25807	FreeBSD : p5-Net-DNS -- multiple Vulnerabilities (d2b8a963-3d59-11dc-b3d3-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	medium
25726	RHEL 3 / 5 : perl-Net-DNS (RHSA-2007:0674)	Nessus	Red Hat Local Security Checks	medium
25721	Mandrake Linux Security Advisory : perl-Net-DNS (MDKSA-2007:146)	Nessus	Mandriva Local Security Checks	medium
25714	CentOS 3 / 5 : perl-Net-DNS (CESA-2007:0674)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2007-3409

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium