CVE-2017-9109
First published: Thu Jun 18 2020(Updated: )
An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNU adns | <1.5.2 | |
| openSUSE Leap | =15.1 | |
| Fedoraproject Fedora | =31 | |
| Fedoraproject Fedora | =32 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00037.html
- http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git
- http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git;a=blob;f=changelog
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ/
- https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html
Frequently Asked Questions
What is the severity of CVE-2017-9109?
The severity of CVE-2017-9109 is critical (9.8).
What software is affected by CVE-2017-9109?
GNU adns version up to 1.5.2, openSUSE Leap 15.1, Fedoraproject Fedora 31, and Fedoraproject Fedora 32 are affected by CVE-2017-9109.
How does CVE-2017-9109 impact adns?
CVE-2017-9109 can cause confusion in adns by interleaving answers for the CNAME target, resulting in unexpected behavior.
How can I fix the vulnerability in adns?
To fix the vulnerability in adns, update to version 1.5.2 or later.
Where can I find more information about CVE-2017-9109?
More information about CVE-2017-9109 can be found at the following references: [1](http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00037.html), [2](http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git), [3](http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git;a=blob;f=changelog).
- collector/nvd-index
- vendor/gnu
- product/adns
- canonical/gnu adns
- vendor/opensuse
- product/leap
- canonical/opensuse leap
- vendor/fedoraproject
- product/fedora
- canonical/fedoraproject fedora