CVE-2007-3409
published 2007-06-26CVE-2007-3409: Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with…
PriorityP430high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
3.49%
87.7th percentile
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libnet-dns-perl | < libnet-dns-perl 0.60-1 (bookworm) | libnet-dns-perl 0.60-1 (bookworm) |
| net-dns | net | < 0.60 | 0.60 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libnet-dns-perl vulnerabilities
vendor_ubuntu·2007-07-13·CVSS 4.3
CVE-2007-3377 [MEDIUM] libnet-dns-perl vulnerabilities
Title: libnet-dns-perl vulnerabilities
Summary: libnet-dns-perl vulnerabilities
Peter Johannes Holzer discovered that the Net::DNS Perl module had
predictable sequence numbers. This could allow remote attackers to
carry out DNS spoofing, leading to possible machine-in-the-middle attacks.
(CVE-2007-3377)
Steffen Ullrich discovered that the Net::DNS Perl module did not correctly
detect recursive compressed responses. A remote attacker could send a
specially crafted packet, causing applications using Net::DNS to crash or
monopolize CPU resources, leading to a denial of service. (CVE-2007-3409)
Instructions: After a standard system upgrade you need to reboot your computer to
effect the necessary changes.
Debian
CVE-2007-3409: libnet-dns-perl - Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial o...
vendor_debian·2007·CVSS 7.5
CVE-2007-3409 [HIGH] CVE-2007-3409: libnet-dns-perl - Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial o...
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.
Scope: local
bookworm: resolved (fixed in 0.60-1)
bullseye: resolved (fixed in 0.60-1)
forky: resolved (fixed in 0.60-1)
sid: resolved (fixed in 0.60-1)
trixie: resolved (fixed in 0.60-1)
Red Hat
Net:: DNS denial of service
vendor_redhat·2006-12-22·CVSS 7.5
CVE-2007-3409 [HIGH] Net:: DNS denial of service
Net:: DNS denial of service
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.
GHSA
GHSA-vf3x-8mv3-rv64: Net::DNS before 0
ghsa_unreviewed·2022-05-03
CVE-2007-3409 [MEDIUM] GHSA-vf3x-8mv3-rv64: Net::DNS before 0
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.
OSV
CVE-2007-3409: Net::DNS before 0
osv·2007-06-26·CVSS 7.5
CVE-2007-3409 [HIGH] CVE-2007-3409: Net::DNS before 0
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004537; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004538; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004540; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access,
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:1; pcre:"/UNION\s+?SELECT/i"; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004536; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id ASCII
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id ASCII
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id ASCII
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id ASCII"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004539; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004535; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
No public exploits indexed.
Bugzilla
CVE-2007-3409 Perl Net::DNS denial of service [Fdevel]
bugzilla·2007-06-26·CVSS 7.5
CVE-2007-3409 [HIGH] CVE-2007-3409 Perl Net::DNS denial of service [Fdevel]
CVE-2007-3409 Perl Net::DNS denial of service [Fdevel]
Fdevel tracking bug: see blocks bug list for full details of the security issue(s).
[bug automatically created by: add-tracking-bugs]
Discussion:
Fixed upstream version is shipped with every current Fedora version.
Bugzilla
CVE-2007-3409 Perl Net::DNS denial of service [FC5]
bugzilla·2007-06-26·CVSS 7.5
CVE-2007-3409 [HIGH] CVE-2007-3409 Perl Net::DNS denial of service [FC5]
CVE-2007-3409 Perl Net::DNS denial of service [FC5]
FC5 tracking bug: see blocks bug list for full details of the security issue(s).
[bug automatically created by: add-tracking-bugs]
Discussion:
Fedora Core 5 reached end of life, so this issue can not be fixed there.
Bugzilla
CVE-2007-3409 Perl Net::DNS denial of service [FC6]
bugzilla·2007-06-26·CVSS 7.5
CVE-2007-3409 [HIGH] CVE-2007-3409 Perl Net::DNS denial of service [FC6]
CVE-2007-3409 Perl Net::DNS denial of service [FC6]
FC6 tracking bug: see blocks bug list for full details of the security issue(s).
[bug automatically created by: add-tracking-bugs]
Discussion:
fc6:CVE-2007-3409 version (perl-Net-DNS, fixed 0.60) #245809
Bugzilla
CVE-2007-3409 Perl Net::DNS denial of service [F7]
bugzilla·2007-06-26·CVSS 7.5
CVE-2007-3409 [HIGH] CVE-2007-3409 Perl Net::DNS denial of service [F7]
CVE-2007-3409 Perl Net::DNS denial of service [F7]
F7 tracking bug: see blocks bug list for full details of the security issue(s).
[bug automatically created by: add-tracking-bugs]
CWE
Improper Input Validation
mitre_cwe
CWE-20 Improper Input Validation
CWE-20: Improper Input Validation
The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.
Input validation is a frequently-used technique
for checking potentially dangerous inputs in order to
ensure that the inputs are safe for processing within the
code, or when communicating with other components. Input can consist of: raw data - strings, numbers, parameters, file contents, etc. metadata - information about the raw data, such as headers or size Data can be simple or structured. Structured data
can be composed of many nested layers, composed of
combinations of metadata and raw data, with other simple or
structured data. Many properties of raw data or metadata may n
CWE
Uncontrolled Recursion
mitre_cwe
CWE-674 Uncontrolled Recursion
CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Modes of Introduction:
Phase: Implementation
Note: The uncontrolled recursion is often due to an improper or missing conditional
Common Consequences:
Scope: Availability. Impact: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory). Resources including CPU, memory, and stack memory could be rapidly consumed or exhausted, eventually leading to an exit or crash.
Scope: Confidentiality. Impact: Read Application Data. In some cases, an application's interpreter might kill a process or thread that appears to be consuming too much resources, such as with PHP's memory_limit setting. When the
ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.aschttp://osvdb.org/37054http://rt.cpan.org/Public/Bug/Display.html?id=27285http://secunia.com/advisories/25829http://secunia.com/advisories/26012http://secunia.com/advisories/26014http://secunia.com/advisories/26055http://secunia.com/advisories/26075http://secunia.com/advisories/26211http://secunia.com/advisories/26231http://secunia.com/advisories/26417http://secunia.com/advisories/26543http://secunia.com/advisories/29354http://www.debian.org/security/2008/dsa-1515http://www.gentoo.org/security/en/glsa/glsa-200708-06.xmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2007:146http://www.net-dns.org/docs/Changes.htmlhttp://www.novell.com/linux/security/advisories/2007_17_sr.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0674.htmlhttp://www.securityfocus.com/archive/1/473871/100/0/threadedhttp://www.securityfocus.com/bid/24669http://www.securitytracker.com/id?1018376http://www.trustix.org/errata/2007/0023/http://www.ubuntu.com/usn/usn-483-1https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10595ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.aschttp://osvdb.org/37054http://rt.cpan.org/Public/Bug/Display.html?id=27285http://secunia.com/advisories/25829http://secunia.com/advisories/26012http://secunia.com/advisories/26014http://secunia.com/advisories/26055http://secunia.com/advisories/26075http://secunia.com/advisories/26211http://secunia.com/advisories/26231http://secunia.com/advisories/26417http://secunia.com/advisories/26543http://secunia.com/advisories/29354http://www.debian.org/security/2008/dsa-1515http://www.gentoo.org/security/en/glsa/glsa-200708-06.xmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2007:146http://www.net-dns.org/docs/Changes.htmlhttp://www.novell.com/linux/security/advisories/2007_17_sr.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0674.htmlhttp://www.securityfocus.com/archive/1/473871/100/0/threadedhttp://www.securityfocus.com/bid/24669http://www.securitytracker.com/id?1018376http://www.trustix.org/errata/2007/0023/http://www.ubuntu.com/usn/usn-483-1https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10595
2007-06-26
Published