CVE-2012-1570: Medium severity MaraDNS MaraDNS vulnerability
It was reported [1],[2] that MaraDNS suffers from a flaw where it is susceptible to spoofing attacks. Due to an error in the cache update policy, which does not properly handle revoked domain names, a remote attacker could keep a domain name resolvable after it has been deleted from the registration.
This flaw is fixed in versions 1.3.0.7.15 and 1.4.12, and is reported to affect all prior versions.
[1] http://www.maradns.org/changelog.html [2] https://secunia.com/advisories/48492/
Other sources
The resolver in MaraDNS before 1.3.0.7.15 and 1.4.x before 1.4.12 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1570?
CVE-2012-1570 is classified as a moderate severity vulnerability due to its potential for spoofing attacks.
How does CVE-2012-1570 affect MaraDNS?
CVE-2012-1570 affects MaraDNS by allowing remote attackers to keep a domain name resolvable after it has been revoked.
How do I fix CVE-2012-1570?
To fix CVE-2012-1570, it is recommended to upgrade to MaraDNS versions later than 1.4.12 or to patch the software as prompted by vendor recommendations.
What versions of MaraDNS are affected by CVE-2012-1570?
CVE-2012-1570 affects MaraDNS versions prior to 1.3.07.15 and versions within the range of 1.4.0 to 1.4.12 inclusive.
Is it possible to mitigate CVE-2012-1570 without upgrading?
Mitigating CVE-2012-1570 without upgrading may involve configuring DNS settings to prevent the caching of revoked domain names, although this may not be completely effective.