peter bassill · operator
$ cve CVE-2009-0858 JSON

CVE-2009-0858 EXPLOIT

5.8
MEDIUM · CVSS 2.0 · EPSS 6.3% (pctl 93)

Patch early

A public exploit exists.

Description

The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via crafted zone data for this subdomain.

Scoring

CVSS5.8 (MEDIUM, v2.0)
VectorAV:N/AC:M/Au:N/C:N/I:P/A:P
EPSS6.28% — more likely to be exploited than 93% of all CVEs
WeaknessCWE-20
On CISA KEVno
Public exploityes
Published2009-03-09
Last modified2026-06-16

Affected (1)

VendorProduct
d.j.bernsteindjbdns

Public exploits

SourceTitleDate
exploit-dbdjbdns 1.05 - Long Response Packet Remote Cache Poisoning2009-02-27

References

→ the Explorer  ·  watch your stack  ·  NVD