A hash collision vulnerability in MaraDNS allows remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/maradns | * | < 1.4.09 | >= 1.4.09 |
MaraDNS is a proxy DNS server with permanent caching.
MaraDNS does not properly randomize hash functions to protect against hash collision attacks.
A remote attacker could send many specially crafted DNS recursive queries, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All MaraDNS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/maradns-1.4.09"
A buffer overflow vulnerability in MaraDNS allows remote attackers to execute arbitrary code or cause a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/maradns | * | < 1.4.06 | >= 1.4.06 |
MaraDNS is a proxy DNS server with permanent caching.
A long DNS hostname with a large number of labels could trigger a buffer overflow in the compress_add_dlabel_points() function of dns/Compress.c.
A remote unauthenticated attacker could execute arbitrary code or cause a Denial of Service.
There is no known workaround at this time.
All MaraDNS users should upgrade to the latest stable version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/maradns-1.4.06"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since February 12, 2011. It is likely that your system is already no longer affected by this issue.
MaraDNS is prone to a Denial of Service vulnerability impacting CNAME resolution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-dns/maradns | * | < 1.2.12.08 | >= 1.2.12.08 |
MaraDNS is a package that implements the Domain Name Service (DNS) with resolver and caching ability.
Michael Krieger reported that a specially crafted DNS could prevent an authoritative canonical name (CNAME) record from being resolved because of an "improper rotation of resource records".
A remote attacker could send specially crafted DNS packets to a vulnerable server, making it unable to resolve CNAME records.
Add "max_ar_chain = 2" to the "marac" configuration file.
All MaraDNS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/maradns-1.2.12.09"