Required CVE Record Information
Description
The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.
References 5 Total
Updated:
This container includes required additional information provided by the CVE Program for this vulnerability.
References 5 Total
- securityfocus.com: 90952 vdb-entryx_transferred
- https://bugzilla.redhat.com/show_bug.cgi?id=1332493 x_transferred
- openwall.com: [oss-security] 20170120 Re: CVE Request: two flaws in hesiod permitting privilege elevation mailing-listx_transferred
- https://github.com/achernya/hesiod/pull/10 x_transferred
- security.gentoo.org: GLSA-201805-01 vendor-advisoryx_transferred