SheerDNS Information Disclosure Vulnerability

Bugtraq ID:	7336
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 14 2003 12:00AM
Updated:	Apr 14 2003 12:00AM
Credit:	Discovery of this issue is credited to Jedi/Sector One <[email protected]>.
Vulnerable:	SheerDNS SheerDNS 1.0
Not Vulnerable:	SheerDNS SheerDNS 1.0.1

SheerDNS Information Disclosure Vulnerability

A vulnerability has been discovered in SheerDNS. Due to insufficient sanitization of DNS requests, an attacker may be able to view the contents of an arbitrary system directory or file. Information obtained by exploiting this issue may aid an attacker in launching further attacks against a target system.

This issue was discovered in SheerDNS version 1.0.0, however, earlier versions may also be affected.

SheerDNS Information Disclosure Vulnerability

An exploit has been made available by Jedi/Sector One <[email protected]>:

• /data/vulnerabilities/exploits/dnsfake.c

SheerDNS Information Disclosure Vulnerability

Solution:
This issue has been addressed in SheerDNS 1.0.1.


SheerDNS SheerDNS 1.0

• SheerDNS sheerdns-1.0.1.tar.gz
  http://threading.2038bug.com/sheerdns/sheerdns-1.0.1.tar.gz

SheerDNS Information Disclosure Vulnerability

References:

• SheerDNS Homepage (SheerDNS)
  
• Multiple vulnerabilities in SheerDNS (Jedi/Sector One )