An issue was discovered in adns before 1.5.2. adns_rr_info mishandles a bogus *datap. The general pattern for formatting integers is to sprintf into a fixed-size buffer. This is correct if the input is in the right range; if it isn't, the buffer may be overrun (depending on the sizes of the types on the current platform). Of course the inputs ought to be right. And there are pointers in there too, so perhaps one could say that the caller ought to check these things. It may be better to require the caller to make the pointer structure right, but to have the code here be defensive about (and tolerate with an error but without crashing) out-of-range integer values. So: it should defend each of these integer conversion sites with a check for the actual permitted range, and return adns_s_invaliddata if not. The lack of this check causes the SOA sign extension bug to be a serious security problem: the sign extended SOA value is out of range, and overruns the buffer when reconverted. This is related to sign extending SOA 32-bit integer fields, and use of a signed data type.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in adns before 1.5.2. adns_rr_info mishandles a bogus *datap. The general pattern     for formatting integers is to sprintf into a fixed-size buffer. This is correct if the input is in the     right range; if it isn't, the buffer may be overrun (depending on the sizes of the types on the current     platform). Of course the inputs ought to be right. And there are pointers in there too, so perhaps one     could say that the caller ought to check these things. It may be better to require the caller to make the     pointer structure right, but to have the code here be defensive about (and tolerate with an error but     without crashing) out-of-range integer values. So: it should defend each of these integer conversion sites     with a check for the actual permitted range, and return adns_s_invaliddata if not. The lack of this check     causes the SOA sign extension bug to be a serious security problem: the sign extended SOA value is out of     range, and overruns the buffer when reconverted. This is related to sign extending SOA 32-bit integer     fields, and use of a signed data type. (CVE-2017-9106)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14399-1 advisory.

  - An issue was discovered in adns before 1.5.2. pap_mailbox822 does not properly check st from     adns__findlabel_next. Without this, an uninitialised stack value can be used as the first label length.
    Depending on the circumstances, an attacker might be able to trick adns into crashing the calling program,     leaking aspects of the contents of some of its memory, causing it to allocate lots of memory, or perhaps     overrunning a buffer. This is only possible with applications which make non-raw queries for SOA or RP     records. (CVE-2017-9103)

  - An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is     encountered. (CVE-2017-9104)

  - An issue was discovered in adns before 1.5.2. It corrupts a pointer when a nameserver speaks first because     of a wrong number of pointer dereferences. This bug may well be exploitable as a remote code execution.
    (CVE-2017-9105)

  - An issue was discovered in adns before 1.5.2. adns_rr_info mishandles a bogus *datap. The general pattern     for formatting integers is to sprintf into a fixed-size buffer. This is correct if the input is in the     right range; if it isn't, the buffer may be overrun (depending on the sizes of the types on the current     platform). Of course the inputs ought to be right. And there are pointers in there too, so perhaps one     could say that the caller ought to check these things. It may be better to require the caller to make the     pointer structure right, but to have the code here be defensive about (and tolerate with an error but     without crashing) out-of-range integer values. So: it should defend each of these integer conversion sites     with a check for the actual permitted range, and return adns_s_invaliddata if not. The lack of this check     causes the SOA sign extension bug to be a serious security problem: the sign extended SOA value is out of     range, and overruns the buffer when reconverted. This is related to sign extending SOA 32-bit integer     fields, and use of a signed data type. (CVE-2017-9106)

  - An issue was discovered in adns before 1.5.2. It overruns reading a buffer if a domain ends with     backslash. If the query domain ended with \, and adns_qf_quoteok_query was specified, qdparselabel would     read additional bytes from the buffer and try to treat them as the escape sequence. It would depart the     input buffer and start processing many bytes of arbitrary heap data as if it were the query domain.
    Eventually it would run out of input or find some other kind of error, and declare the query domain     invalid. But before then it might outrun available memory and crash. In principle this could be a denial     of service attack. (CVE-2017-9107)

  - An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read.
    It is wrong to increment used as well as setting r, since used is incremented according to r, later.
    Rather one should be doing what read() would have done. Without this fix, adnshost may read and process     one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.
    (CVE-2017-9108)

  - An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that     was found the first time. when this is fixed, the second answer scan finds the same RRs at the first.
    Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In     that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only     at the answer RRs which come after the CNAME, which is at least arguably correct. (CVE-2017-9109)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Ian Jackson and the adns project reports :

Vulnerable applications: all adns callers. Exploitable by: the local recursive resolver. Likely worst case: Remote code execution.

Vulnerable applications: those that make SOA queries. Exploitable by:
upstream DNS data sources. Likely worst case: DoS (crash of the adns-using application)

Vulnerable applications: those that use adns_qf_quoteok_query.
Exploitable by: sources of query domain names. Likely worst case: DoS (crash of the adns-using application)

Vulnerable applications: adnshost. Exploitable by: code responsible for framing the input. Likely worst case: DoS (adnshost crashes at EOF).

This update for adns fixes the following issues :

  - CVE-2017-9103,CVE-2017-9104,CVE-2017-9105,CVE-2017-9109:
    Fixed an issue in local recursive resolver which could     have led to remote code execution (bsc#1172265).

  - CVE-2017-9106: Fixed an issue with upstream DNS data     sources which could have led to denial of service     (bsc#1172265).

  - CVE-2017-9107: Fixed an issue when quering domain names     which could have led to denial of service (bsc#1172265).

  - CVE-2017-9108: Fixed an issue which could have led to     denial of service (bsc#1172265).

This update was imported from the SUSE:SLE-15:Update update project.

New upstream release

  - Important security fixes: CVE-2017-9103 CVE-2017-9104     CVE-2017-9105 CVE-2017-9109: &#9;Vulnerable     applications: all adns callers. Exploitable by: the     local recursive resolver. &#9;Likely worst case: Remote     code execution. CVE-2017-9106: &#9;Vulnerable     applications: those that make SOA queries. Exploitable     by: upstream DNS data sources. &#9;Likely worst case:
    DoS (crash of the adns-using application) CVE-2017-9107:
    &#9;Vulnerable applications: those that use     adns_qf_quoteok_query. Exploitable by: sources of query     domain names. &#9;Likely worst case: DoS (crash of the     adns-using application) CVE-2017-9108: &#9;Vulnerable     applications: adnshost. Exploitable by: code responsible     for framing the input. Likely worst case: DoS (adnshost     crashes at EOF). All found by AFL 2.35b. Thanks to the     University of Cambridge Department of Applied     Mathematics for computing facilities.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for adns fixes the following issues :

CVE-2017-9103,CVE-2017-9104,CVE-2017-9105,CVE-2017-9109: Fixed an issue in local recursive resolver which could have led to remote code execution (bsc#1172265).

CVE-2017-9106: Fixed an issue with upstream DNS data sources which could have led to denial of service (bsc#1172265).

CVE-2017-9107: Fixed an issue when quering domain names which could have led to denial of service (bsc#1172265).

CVE-2017-9108: Fixed an issue which could have led to denial of service (bsc#1172265).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
254011	Linux Distros Unpatched Vulnerability : CVE-2017-9106	Nessus	Misc.	Local	high
150522	SUSE SLES11 Security Update : adns (SUSE-SU-2020:14399-1)	Nessus	SuSE Local Security Checks	Local	critical
139738	FreeBSD : adns -- multiple vulnerabilities (08de38d2-e2d0-11ea-9538-0c9d925bbbc0)	Nessus	FreeBSD Local Security Checks	Local	critical
138690	openSUSE Security Update : adns (openSUSE-2020-827)	Nessus	SuSE Local Security Checks	Local	critical
137928	Fedora 31 : adns (2020-e59bcaf702)	Nessus	Fedora Local Security Checks	Local	critical
137926	Fedora 32 : adns (2020-530188bf36)	Nessus	Fedora Local Security Checks	Local	critical
137621	SUSE SLES12 Security Update : adns (SUSE-SU-2020:1612-1)	Nessus	SuSE Local Security Checks	Local	critical

Detections

Analytics

CVE-2017-9106

high

Tenable Plugins

high

critical

critical

critical

critical

critical

critical