CVE-2017-14339 Denial of service in n/a
Attackers can cause a denial of service in YADIFA DNS servers by triggering an infinite loop in the packet parser, leading to high CPU usage and unresponsiveness.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-14339?
CVE-2017-14339 is a high-severity denial of service vulnerability in n/a, published on 20 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The DNS packet parser in YADIFA before 2.2.6 does not check for the presence of infinite pointer loops, and thus it is possible to force it to enter an infinite loop. This can cause high CPU usage and makes the server unresponsive.
Weakness: CWE-835
Which versions are affected by CVE-2017-14339?
It affects 1 product.
Products include Yadifa Yadifa.
How do I fix CVE-2017-14339?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-14339 being exploited?
There is no known exploitation of CVE-2017-14339 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2017-14339, DSA-4001-1, GHSA-4g52-pmx3-v5c4, UBUNTU-CVE-2017-14339.