BID:26539

nss-mdns NSS.C Remote Denial of Service Vulnerability

Info

nss-mdns NSS.C Remote Denial of Service Vulnerability

Bugtraq ID:	26539
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 22 2007 12:00AM
Updated:	Nov 22 2007 07:14PM
Credit:	Daniel Smolik is credited with the discovery of this vulnerability.
Vulnerable:	nss-mdns nss-mdns 0.9 nss-mdns nss-mdns 0.8 nss-mdns nss-mdns 0.7 nss-mdns nss-mdns 0.6 nss-mdns nss-mdns 0.5 nss-mdns nss-mdns 0.4 nss-mdns nss-mdns 0.3 nss-mdns nss-mdns 0.2 nss-mdns nss-mdns 0.1 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0

Not Vulnerable:	nss-mdns nss-mdns 0.10

Discussion

nss-mdns NSS.C Remote Denial of Service Vulnerability

The 'nss-mdns' tool is prone to a denial-of-service vulnerability that occurs when the library fails to handle miss-aligned data structures.

An attacker could exploit this issue to crash the application using the affected library, denying further service to legitimate users.

Versions prior to nss-mdns 0.10 are vulnerable.

Exploit / POC

nss-mdns NSS.C Remote Denial of Service Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Solution / Fix

nss-mdns NSS.C Remote Denial of Service Vulnerability

Solution:
The vendor released nss-mdns 0.10 to address this issue. Please see the references for more information.

nss-mdns nss-mdns 0.3