CVE-2018-1046 — Stack-based Buffer Overflow in Pdns

CWE-121 — Stack-based Buffer OverflowCWE-787 — Out-of-bounds Write10 documents7 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 99.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Open-xchange PdnsPowerdns Pdns
Timeline
PublishedJul 16
Latest updateJan 14

Description

pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the -ecs-stamp option of dnsreplay is used.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶NVDpowerdns/pdns< 4.1.2
▶Debianopen-xchange/pdns< 4.1.2-1+3
▶Ubuntuopen-xchange/pdns< 4.0.0~alpha2-3ubuntu0.1~esm1+3

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

4
OSV
pdns, pdns-recursor vulnerabilities↗2025-01-14
▶
GHSA
GHSA-622f-mfw7-jxg6: pdns before version 4↗2022-05-13
▶
CVEList
CVE-2018-1046: pdns before version 4↗2018-07-16
▶
OSV
CVE-2018-1046: pdns before version 4↗2018-07-16
▶

📋Vendor Advisories

2
Ubuntu
PowerDNS vulnerabilities↗2025-01-14
▶
Debian
CVE-2018-1046: pdns - pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In th...↗2018
▶

💬Community

3
Bugzilla
CVE-2018-14320 podofo: Lack of proper validation of user supplied data can result in information disclosure↗2018-09-20
▶
Bugzilla
CVE-2018-1046 pdns: Buffer overflow in dnsreplay [fedora-all]↗2018-05-17
▶
Bugzilla
CVE-2018-1046 pdns: Buffer overflow in dnsreplay↗2018-05-17
▶
CVE-2018-1046 — Stack-based Buffer Overflow in Pdns | cvebase