critical
10
CWE
119
Advisory Published
CVE Published
Updated

CVE-2009-4009: Buffer Overflow

First published: Mon Jan 04 2010(Updated: )

<a href="https://access.redhat.com/security/cve/CVE-2009-4009">CVE-2009-4009</a>, <a href="https://access.redhat.com/security/cve/CVE-2009-4010">CVE-2009-4010</a> <span class="quote">&gt; This Wednesday the release of the PowerDNS Recursor 3.1.7.2 will be made &gt; public, which fixes two important security issues, one of which is remotely &gt; exploitable. &gt; &gt; Given the critical nature of these vulnerabilities, we are trying to keep &gt; details confidential for a few more days. &gt; &gt; Summary &gt; ------- &gt; The short version: please contact me off-list if you distribute the PowerDNS &gt; Recursor (any version), and if you want to gain early access to version &gt; 3.1.7.2 and associated release notes. &gt; &gt; Details &gt; ------- &gt; The two security issues have been discovered by two parties which we cannot &gt; yet publicly mention or thank, but they deserve full credit and gratitude &gt; for their discoveries. &gt; &gt; Two CVE numbers have been requested, they will be communicated ASAP. &gt; &gt; One issue is remotely exploitable, and there are no configuration &gt; countermeasures. The other allows a (skilled) attacker to spoof domain data &gt; for domain names he does not own. &gt; &gt; The first issue is at least a DoS, but in all likelihood can be expanded &gt; into a full compromise ('rooted'). &gt; &gt; The release that will be made public is already available for distributors. &gt; Other good news is that it is already serving over a million ISP customers, &gt; with no apparent problems. &gt; &gt; Contact me off-list for quick access to the new PowerDNS Recursor code, &gt; patch &amp; release notes. &gt; &gt; If you need any kind of assistance in doing a smooth upgrade, also do not &gt; hesitate to contact me.</span>

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
redhat/3.1.7.2<1.el5
1.el5
PowerDNS=3.1.7
PowerDNS=3.1
PowerDNS=2.9.18
PowerDNS=2.0_rc1
PowerDNS=3.1.2
PowerDNS=3.0
PowerDNS=2.9.15
PowerDNS=3.1.5
PowerDNS=3.1.1
PowerDNS=3.0.1
PowerDNS<=3.1.7.2
PowerDNS=2.9.17
PowerDNS=3.1.7.1
PowerDNS=2.8
PowerDNS=3.1.3
PowerDNS=2.9.16
PowerDNS=3.1.4
PowerDNS=3.1.6

Remedy

http://www.securityfocus.com/bid/37650

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2009-4009?

    CVE-2009-4009 is classified as a critical vulnerability that can lead to remote code execution.

  • How do I fix CVE-2009-4009?

    To remedy CVE-2009-4009, upgrade to PowerDNS Recursor version 3.1.7.2 or later.

  • What versions of PowerDNS are affected by CVE-2009-4009?

    PowerDNS Recursor versions up to 3.1.7.1 are affected by CVE-2009-4009.

  • Is CVE-2009-4009 related to other vulnerabilities?

    Yes, CVE-2009-4009 is associated with CVE-2009-4010 as part of a security release.

  • What is the impact of CVE-2009-4009 if exploited?

    Exploitation of CVE-2009-4009 can allow an attacker to execute arbitrary code on the affected system.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203