CVE-2010-2444: Null Pointer Dereference
Published Jun 25, 2010
·Updated
parse/Csv2parse.c in MaraDNS 1.3.03, and other versions before 1.4.03, does not properly handle hostnames that do not end in a "." (dot) character, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted csv2 zone file.
Affected Software
22 affected components
MaraDNS MaraDNS=1.3.10
MaraDNS MaraDNS=1.3.07.07
MaraDNS MaraDNS=1.4.01
MaraDNS MaraDNS=1.3.03
MaraDNS MaraDNS=1.3.07.04
MaraDNS MaraDNS=1.3.07.08
MaraDNS MaraDNS=1.3.05
MaraDNS MaraDNS=1.3.13
MaraDNS MaraDNS=1.3.06
MaraDNS MaraDNS=1.3.08
MaraDNS MaraDNS=1.3.07.03
MaraDNS MaraDNS=1.4.02
MaraDNS MaraDNS=1.3.07.01
MaraDNS MaraDNS=1.3.12
MaraDNS MaraDNS=1.3.07.06
MaraDNS MaraDNS=1.3.07.09
MaraDNS MaraDNS=1.3.11
MaraDNS MaraDNS=1.3.09
MaraDNS MaraDNS=1.3.07.05
MaraDNS MaraDNS=1.3.07.02
MaraDNS MaraDNS=1.3.04
MaraDNS MaraDNS=1.3.14
Remediation
Patch Available
Event History
Jun 25, 2010
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2010-2444?
CVE-2010-2444 has a medium severity rating, leading to a denial of service via a NULL pointer dereference.
2
How do I fix CVE-2010-2444?
To fix CVE-2010-2444, upgrade MaraDNS to version 1.4.03 or later.
3
What versions of MaraDNS are affected by CVE-2010-2444?
CVE-2010-2444 affects MaraDNS versions 1.3.03 to 1.3.14.
4
What type of attack does CVE-2010-2444 enable?
CVE-2010-2444 allows remote attackers to execute a denial of service attack by exploiting malformed csv2 zone files.
5
Is there a patch available for CVE-2010-2444?
Yes, a patch for CVE-2010-2444 can be found in the upgrade to MaraDNS version 1.4.03.