CVE-2017-14339 - The DNS packet parser in YADIFA before 2.2.6 does not check for the presence of infinite pointer loops, and thus it is possible to force it to enter an infinite loop

Back Back to CVE browser

HIGH

The DNS packet parser in YADIFA before 2.2.6 does not check for the presence of infinite pointer loops, and thus it is possible to force it to enter an infinite loop

Published Sep 20, 2017

7.5

HIGH

CVSS 3.0

EPSS 2.53%

Description

The DNS packet parser in YADIFA before 2.2.6 does not check for the presence of infinite pointer loops, and thus it is possible to force it to enter an infinite loop. This can cause high CPU usage and makes the server unresponsive.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-835

References (3)

http://www.debian.org/security/2017/dsa-4001
vendor-advisoryx_refsource_DEBIAN
https://github.com/yadifa/yadifa/blob/v2.2.6/ChangeLog
x_refsource_CONFIRMThird Party Advisory
https://www.tarlogic.com/blog/fuzzing-yadifa-dns/
x_refsource_MISCExploitTechnical DescriptionThird Party Advisory

Link	Providers	Tags
http://www.debian.org/security/2017/dsa-4001		vendor-advisoryx_refsource_DEBIAN
https://github.com/yadifa/yadifa/blob/v2.2.6/ChangeLog		x_refsource_CONFIRMThird Party Advisory
https://www.tarlogic.com/blog/fuzzing-yadifa-dns/		x_refsource_MISCExploitTechnical DescriptionThird Party Advisory