Details of VAR-200512-0640

ID

VAR-200512-0640

CVE

CVE-2005-0036

TITLE

DNS implementations vulnerable to denial-of-service attacks via malformed DNS queries

Trust: 0.8

sources: CERT/CC: VU#23495

DESCRIPTION

The DNS implementation in DeleGate 8.10.2 and earlier allows remote attackers to cause a denial of service via a compressed DNS packet with a label length byte with an incorrect offset, which could trigger an infinite loop. Note that some other DNS packet processing systems have the issues related to this vulnerability. Multiple DNS vendors are susceptible to a remote denial-of-service vulnerability. This issue affects both DNS servers and clients. This issue arises when an affected application handles a specially crafted DNS message. A successful attack would crash the affected client or server. ---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: Cisco Various Products Compressed DNS Messages Denial of Service SECUNIA ADVISORY ID: SA15472 VERIFY ADVISORY: http://secunia.com/advisories/15472/ CRITICAL: Less critical IMPACT: DoS WHERE: >From remote OPERATING SYSTEM: Cisco ATA 180 Series Analog Telephone Adaptors http://secunia.com/product/2810/ SOFTWARE: Cisco IP Phone 7900 Series http://secunia.com/product/2809/ Cisco ACNS Software Version 5.x http://secunia.com/product/2268/ Cisco ACNS Software Version 4.x http://secunia.com/product/2269/ Cisco Unity Express 2.x http://secunia.com/product/5151/ DESCRIPTION: A vulnerability has been reported in various Cisco products, which can be exploited by malicious people to cause a DoS (Denial of Service). Successful exploitation crashes a vulnerable device or causes it to function abnormally. The vulnerability affects the following products: * Cisco IP Phones 7902/7905/7912 * Cisco ATA (Analog Telephone Adaptor) 186/188 * Cisco Unity Express The following Cisco ACNS (Application and Content Networking System) devices are also affected: * Cisco 500 Series Content Engines * Cisco 7300 Series Content Engines * Cisco Content Routers 4400 series * Cisco Content Distribution Manager 4600 series * Cisco Content Engine Module for Cisco 2600, 2800, 3600, 3700, and 3800 series Integrated Service Routers. SOLUTION: See patch matrix in vendor advisory for information about fixes. http://www.cisco.com/warp/public/707/cisco-sn-20050524-dns.shtml#software PROVIDED AND/OR DISCOVERED BY: NISCC credits Dr. Steve Beaty. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sn-20050524-dns.shtml NISCC: http://www.niscc.gov.uk/niscc/docs/al-20050524-00433.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.79

sources: NVD: CVE-2005-0036 // CERT/CC: VU#23495 // JVNDB: JVNDB-2005-000343 // BID: 13729 // VULMON: CVE-2005-0036 // PACKETSTORM: 37713

AFFECTED PRODUCTS

vendor:	delegate	model:	delegate	scope:	eq	version:	8.10.1	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	8.10	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	8.9.6	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	8.9.5	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	8.9.4	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	8.9.3	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	8.9.2	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	8.9.1	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	8.9	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	8.5.0	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	8.4.0	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	8.3.4	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	8.3.3	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	7.9.11	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	7.8.2	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	7.8.1	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	7.8.0	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	7.7.1	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	7.7.0	Trust: 1.3
vendor:	delegate	model:	delegate	scope:	eq	version:	5.9.3	Trust: 1.0
vendor:	etl	model:	delegate	scope:	eq	version:	6.0	Trust: 1.0
vendor:	etl	model:	delegate	scope:	eq	version:	5.9	Trust: 1.0
vendor:	delegate	model:	delegate	scope:	lte	version:	8.10.2	Trust: 1.0
vendor:	delegate	model:	delegate	scope:	eq	version:	8.10.2	Trust: 0.9
vendor:	ethereal	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	tcpdump	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	delegate	model:	delegate	scope:	eq	version:	8.10.2 and eariler	Trust: 0.8
vendor:	cisco	model:	application & content networking software	scope:	-	version:	-	Trust: 0.6
vendor:	powerdns	model:	powerdns	scope:	eq	version:	2.9.16	Trust: 0.3
vendor:	powerdns	model:	powerdns	scope:	eq	version:	2.9.15	Trust: 0.3
vendor:	powerdns	model:	powerdns	scope:	eq	version:	2.8	Trust: 0.3
vendor:	powerdns	model:	rc1	scope:	eq	version:	2.0	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	2.10	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	2.9	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	2.8	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	2.7	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	2.6	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	2.5	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	2.4	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	2.3	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	2.2	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	2.1	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	2.0	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	1.4	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	1.3	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	1.2	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	1.1	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	eq	version:	1.0	Trust: 0.3
vendor:	cisco	model:	unity express	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	subscriber edge services manager	scope:	eq	version:	3.3(1)	Trust: 0.3
vendor:	cisco	model:	subscriber edge services manager	scope:	eq	version:	3.2(2)	Trust: 0.3
vendor:	cisco	model:	subscriber edge services manager	scope:	eq	version:	3.2(1)	Trust: 0.3
vendor:	cisco	model:	ip phone	scope:	eq	version:	79120	Trust: 0.3
vendor:	cisco	model:	ip phone	scope:	eq	version:	7905	Trust: 0.3
vendor:	cisco	model:	ip phone	scope:	eq	version:	7902	Trust: 0.3
vendor:	cisco	model:	content router	scope:	eq	version:	4450	Trust: 0.3
vendor:	cisco	model:	content router	scope:	eq	version:	44304.1	Trust: 0.3
vendor:	cisco	model:	content router	scope:	eq	version:	44304.0	Trust: 0.3
vendor:	cisco	model:	content router	scope:	eq	version:	4430	Trust: 0.3
vendor:	cisco	model:	content engine module for cisco router series	scope:	eq	version:	3800	Trust: 0.3
vendor:	cisco	model:	content engine module for cisco router series	scope:	eq	version:	3700	Trust: 0.3
vendor:	cisco	model:	content engine module for cisco router series	scope:	eq	version:	3600	Trust: 0.3
vendor:	cisco	model:	content engine module for cisco router series	scope:	eq	version:	2800	Trust: 0.3
vendor:	cisco	model:	content engine module for cisco router series	scope:	eq	version:	2600	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	7325	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	73204.1	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	73204.0	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	73203.1	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	73202.2.0	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	7320	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	5904.1	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	5904.0	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	5903.1	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	5902.2.0	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	590	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	565	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	5604.1	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	5604.0	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	5603.1	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	5602.2.0	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	560	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	510	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	5074.1	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	5074.0	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	5073.1	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	5072.2.0	Trust: 0.3
vendor:	cisco	model:	content engine	scope:	eq	version:	507	Trust: 0.3
vendor:	cisco	model:	content distribution manager	scope:	eq	version:	4670	Trust: 0.3
vendor:	cisco	model:	content distribution manager	scope:	eq	version:	46504.1	Trust: 0.3
vendor:	cisco	model:	content distribution manager	scope:	eq	version:	46504.0	Trust: 0.3
vendor:	cisco	model:	content distribution manager	scope:	eq	version:	4650	Trust: 0.3
vendor:	cisco	model:	content distribution manager	scope:	eq	version:	46304.1	Trust: 0.3
vendor:	cisco	model:	content distribution manager	scope:	eq	version:	46304.0	Trust: 0.3
vendor:	cisco	model:	content distribution manager	scope:	eq	version:	4630	Trust: 0.3
vendor:	cisco	model:	ata-188	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ata-186	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	5.2.3.9	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	5.2.1.7	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	5.2	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	5.1.13.7	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	5.1.11.6	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	5.1	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	5.0.17.6	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	5.0.5	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	5.0.3	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	5.0.1	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	5.0	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	4.2.11	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	4.2.9	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	4.2.7	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	4.2	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	4.1.3	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	4.1.1	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	eq	version:	4.0.3	Trust: 0.3
vendor:	powerdns	model:	powerdns	scope:	ne	version:	2.9.17	Trust: 0.3
vendor:	dnrd	model:	dnrd	scope:	ne	version:	2.18	Trust: 0.3
vendor:	delegate	model:	delegate	scope:	ne	version:	8.11.1	Trust: 0.3
vendor:	delegate	model:	delegate	scope:	ne	version:	8.11	Trust: 0.3
vendor:	delegate	model:	delegate	scope:	ne	version:	8.10.6	Trust: 0.3
vendor:	delegate	model:	delegate	scope:	ne	version:	8.10.5	Trust: 0.3
vendor:	delegate	model:	delegate	scope:	ne	version:	8.10.4	Trust: 0.3
vendor:	delegate	model:	delegate	scope:	ne	version:	8.10.3	Trust: 0.3
vendor:	cisco	model:	subscriber edge services manager	scope:	ne	version:	3.3(2)	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	ne	version:	5.3.3	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	ne	version:	5.2.7	Trust: 0.3
vendor:	cisco	model:	application & content networking software	scope:	ne	version:	5.1.15	Trust: 0.3

sources: CERT/CC: VU#23495 // BID: 13729 // JVNDB: JVNDB-2005-000343 // CNNVD: CNNVD-200512-967 // NVD: CVE-2005-0036

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2005-0036
value:	MEDIUM
Trust: 1.0
CARNEGIE MELLON:	VU#23495
value:	41.92
Trust: 0.8
NVD:	CVE-2005-0036
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-200512-967
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2005-0036
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2005-0036
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9

sources: CERT/CC: VU#23495 // VULMON: CVE-2005-0036 // JVNDB: JVNDB-2005-000343 // CNNVD: CNNVD-200512-967 // NVD: CVE-2005-0036

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2005-0036

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200512-967

TYPE

Design Error

Trust: 0.9

sources: BID: 13729 // CNNVD: CNNVD-200512-967

CONFIGURATIONS

sources: JVNDB: JVNDB-2005-000343

PATCH

title:

Top Page

url:

http://www.delegate.org/delegate/

Trust: 0.8

sources: JVNDB: JVNDB-2005-000343

EXTERNAL IDS

db:	BID	id:	13729	Trust: 3.6
db:	NVD	id:	CVE-2005-0036	Trust: 2.8
db:	OSVDB	id:	25291	Trust: 1.7
db:	SECUNIA	id:	15472	Trust: 0.9
db:	SECTRACK	id:	1014043	Trust: 0.8
db:	SECTRACK	id:	1014044	Trust: 0.8
db:	SECTRACK	id:	1014045	Trust: 0.8
db:	SECTRACK	id:	1014046	Trust: 0.8
db:	BID	id:	1165	Trust: 0.8
db:	CERT/CC	id:	VU#23495	Trust: 0.8
db:	JVNDB	id:	JVNDB-2005-000343	Trust: 0.8
db:	CNNVD	id:	CNNVD-200512-967	Trust: 0.6
db:	VULMON	id:	CVE-2005-0036	Trust: 0.1
db:	PACKETSTORM	id:	37713	Trust: 0.1

sources: CERT/CC: VU#23495 // VULMON: CVE-2005-0036 // BID: 13729 // JVNDB: JVNDB-2005-000343 // PACKETSTORM: 37713 // CNNVD: CNNVD-200512-967 // NVD: CVE-2005-0036

REFERENCES

url:	http://www.securityfocus.com/bid/13729	Trust: 3.3
url:	http://www.niscc.gov.uk/niscc/docs/al-20050524-00433.html	Trust: 2.9
url:	http://www.niscc.gov.uk/niscc/docs/re-20050524-00432.pdf?lang=en	Trust: 1.7
url:	http://www.osvdb.org/25291	Trust: 1.7
url:	http://www.cisco.com/warp/public/707/cisco-sn-20050524-dns.shtml	Trust: 1.2
url:	http://secunia.com/advisories/15472/	Trust: 0.9
url:	http://www.securityfocus.com/bid/1165	Trust: 0.8
url:	http://www.ciac.org/ciac/bulletins/l-015.shtml	Trust: 0.8
url:	http://www.securitytracker.com/id?1014046	Trust: 0.8
url:	http://www.securitytracker.com/id?1014045	Trust: 0.8
url:	http://www.securitytracker.com/id?1014044	Trust: 0.8
url:	http://www.securitytracker.com/id?1014043	Trust: 0.8
url:	http://www.ethereal.com	Trust: 0.8
url:	http://www.tcpdump.org	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2005-0036	Trust: 0.8
url:	http://www.cpni.gov.uk/products/vulnerabilitydisclosures/default.aspx?id=va-20050524-00432.xml	Trust: 0.8
url:	http://www.frsirt.com/english/advisories/2005/0610	Trust: 0.8
url:	http://jvn.jp/niscc/niscc-589088/index.html	Trust: 0.8
url:	http://nvd.nist.gov/nvd.cfm?cvename=cve-2005-0036	Trust: 0.8
url:	http://www.cpni.gov.uk/docs/re-20050524-00432.pdf?lang=en	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	http://tools.cisco.com/security/center/viewalert.x?alertid=9258	Trust: 0.1
url:	http://secunia.com/product/2810/	Trust: 0.1
url:	http://secunia.com/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/about_secunia_advisories/	Trust: 0.1
url:	http://secunia.com/product/5151/	Trust: 0.1
url:	http://www.cisco.com/warp/public/707/cisco-sn-20050524-dns.shtml#software	Trust: 0.1
url:	http://secunia.com/secunia_vacancies/	Trust: 0.1
url:	http://secunia.com/product/2268/	Trust: 0.1
url:	http://secunia.com/product/2269/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/product/2809/	Trust: 0.1

sources: CERT/CC: VU#23495 // VULMON: CVE-2005-0036 // BID: 13729 // JVNDB: JVNDB-2005-000343 // PACKETSTORM: 37713 // CNNVD: CNNVD-200512-967 // NVD: CVE-2005-0036

CREDITS

Discovered by Dr. Steve Beaty from the Department of Mathematical and Computer Sciences at the Metropolitan State College of Denver.

Trust: 0.9

sources: BID: 13729 // CNNVD: CNNVD-200512-967

SOURCES

db:	CERT/CC	id:	VU#23495
db:	VULMON	id:	CVE-2005-0036
db:	BID	id:	13729
db:	JVNDB	id:	JVNDB-2005-000343
db:	PACKETSTORM	id:	37713
db:	CNNVD	id:	CNNVD-200512-967
db:	NVD	id:	CVE-2005-0036

LAST UPDATE DATE

2024-08-14T13:39:56.366000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#23495	date:	2005-11-15T00:00:00
db:	VULMON	id:	CVE-2005-0036	date:	2008-09-05T00:00:00
db:	BID	id:	13729	date:	2016-07-06T14:40:00
db:	JVNDB	id:	JVNDB-2005-000343	date:	2008-05-21T00:00:00
db:	CNNVD	id:	CNNVD-200512-967	date:	2010-06-23T00:00:00
db:	NVD	id:	CVE-2005-0036	date:	2008-09-05T20:45:07.777

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#23495	date:	2001-06-18T00:00:00
db:	VULMON	id:	CVE-2005-0036	date:	2005-12-31T00:00:00
db:	BID	id:	13729	date:	2005-05-24T00:00:00
db:	JVNDB	id:	JVNDB-2005-000343	date:	2008-05-21T00:00:00
db:	PACKETSTORM	id:	37713	date:	2005-05-29T20:22:44
db:	CNNVD	id:	CNNVD-200512-967	date:	2005-12-31T00:00:00
db:	NVD	id:	CVE-2005-0036	date:	2005-12-31T05:00:00