CVE-2007-3409

HIGH

Net::DNS < 0.60 - Denial of Service via Malformed Compressed DNS Packet

Title source: llm
STIX 2.1

Description

Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.

References (25)

Core 25
Core References
Broken Link vdb-entry x_refsource_osvdb
http://osvdb.org/37054
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26231
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26417
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29354
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26014
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26012
Broken Link x_refsource_confirm
http://rt.cpan.org/Public/Bug/Display.html?id=27285
Mailing List, Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2008/dsa-1515
Release Notes x_refsource_confirm
http://www.net-dns.org/docs/Changes.html
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1018376
Broken Link vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2007_17_sr.html
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26543
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-483-1
Broken Link vendor-advisory x_refsource_trustix
http://www.trustix.org/errata/2007/0023/
Third Party Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2007:146
Broken Link vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0674.html
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26055
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26211
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26075
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/24669
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25829
Third Party Advisory vendor-advisory x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-200708-06.xml
Broken Link, Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/473871/100/0/threaded

Scores

CVSS v3 7.5
EPSS 0.0349
EPSS Percentile 87.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-674
Status published
Products (5)
canonical/ubuntu_linux 6.06
canonical/ubuntu_linux 6.10
debian/debian_linux 3.1
debian/debian_linux 4.0
net-dns/net\ < 0.60
Published Jun 26, 2007
Tracked Since Feb 18, 2026