A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ldns: Memory corruption in ldns_rr_new_frm_fp_l (CVE-2017-1000231)

  - The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which     might allow local users to obtain the private key by reading the file. (CVE-2014-3209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ldns: Memory corruption in ldns_rr_new_frm_fp_l (CVE-2017-1000231)

  - The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which     might allow local users to obtain the private key by reading the file. (CVE-2014-3209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for ldns fixes the following issues :

  - CVE-2017-1000231: Fixed a buffer overflow during token     parsing (bsc#1068711).

  - CVE-2017-1000232: Fixed a double-free vulnerability in     str2host.c (bsc#1068709).

This update was imported from the SUSE:SLE-15:Update update project.

This update for ldns fixes the following issues :

CVE-2017-1000231: Fixed a buffer overflow during token parsing (bsc#1068711).

CVE-2017-1000232: Fixed a double-free vulnerability in str2host.c (bsc#1068709).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ldns package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A double-free vulnerability in parse.c in ldns 1.7.0     have unspecified impact and attack     vectors.(CVE-2017-1000231)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ldns package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A double-free vulnerability in parse.c in ldns 1.7.0     have unspecified impact and attack     vectors.(CVE-2017-1000231)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Leon Weber discovered that the ldns-keygen tool incorrectly set permissions on private keys. A local attacker could possibly use this issue to obtain generated private keys. This issue only applied to Ubuntu 14.04 LTS. (CVE-2014-3209)

Stephan Zeisberg discovered that ldns incorrectly handled memory when processing data. A remote attacker could use this issue to cause ldns to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-1000231, CVE-2017-1000232).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A security vulnerability has been discovered in ldns, a library and collection of utilities for DNS programming.

CVE-2017-1000231

The generic parser contained a double-free vulnerability which resulted in an application crash with unspecified impacts and attack vectors.

For Debian 7 'Wheezy', these problems have been fixed in version 1.6.13-1+deb7u2.

We recommend that you upgrade your ldns packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199642	RHEL 7 : ldns (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199558	RHEL 6 : ldns (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
135163	openSUSE Security Update : ldns (openSUSE-2020-438)	Nessus	SuSE Local Security Checks	critical
134972	SUSE SLED15 / SLES15 Security Update : ldns (SUSE-SU-2020:0801-1)	Nessus	SuSE Local Security Checks	critical
117540	EulerOS Virtualization 2.5.0 : ldns (EulerOS-SA-2018-1231)	Nessus	Huawei Local Security Checks	critical
105318	EulerOS 2.0 SP2 : ldns (EulerOS-SA-2017-1337)	Nessus	Huawei Local Security Checks	critical
105317	EulerOS 2.0 SP1 : ldns (EulerOS-SA-2017-1336)	Nessus	Huawei Local Security Checks	critical
104784	Ubuntu 14.04 LTS / 16.04 LTS : ldns vulnerabilities (USN-3491-1)	Nessus	Ubuntu Local Security Checks	critical
104709	Debian DLA-1182-1 : ldns security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-1000231

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical