CVE-2016-10152

Published: Mar 28, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.

Affected (1)

Products: Hesiod Project: Hesiod

Hesiod Project

1 product

Hesiod

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hesiod Project Hesiod	version ≤ 3.2.1

Related CWEs

CWE-264

References (10)

http://www.openwall.com/lists/oss-security/2017/01/21/1

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/90952

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=1332493

Source: cve@mitre.org

Issue Tracking

https://github.com/achernya/hesiod/pull/10

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://security.gentoo.org/glsa/201805-01

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2017/01/21/1