Summary
Ein Angreifer kann mehrere Schwachstellen in Meinberg LANTIME ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, sensible Informationen offenzulegen, Daten zu manipulieren oder Denial-of-Service-Zustände herbeizuführen.
Product
Die Meinberg Produktfamilie LANTIME, umfasst NTP Zeitserver in unterschiedlichsten Bauformen zur einfachen Zeitsynchronisation
Vulnerabilities 56
-
High 8.8
ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly
ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB r…
-
High 8.6
DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1,…
-
High 8.4
Integer overflow in memalign leads to heap corruption
Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attack…
-
High 8.1
ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR
ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the un…
-
High 7.7
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This…
-
High 7.5
wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory
Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.
-
High 7.5CVE-2026-0915 Public exploit
getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler
Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS r…
-
High 7.5
Potential wildcard CNAME RPZ policy bypass
An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not handled correctly and may lead to defeating the RPZ rule. It…
-
High 7.5
Unnecessary validation of DNSSEC signed records
The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RR…
-
High 7.5
Potential memory usage beyond configured limits
A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage c…
-
High 7.5
Cache poisoning possible with label count discrepancy, RRSIG, and wildcards
It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, wh…
-
High 7.5
Record ordering based unexpected exit with CNAME or DNAME
The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative …
-
High 7.5
Unexpected exit in certain situations with NSEC and NSEC3 both present
If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.…
-
High 7.5
Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers …
-
High 7.5
iconv crash due to assertion failure with untrusted input
The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be triviall…
-
High 7.5
Packet of death for DNSCrypt over TCP
In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied…
-
High 7.5
gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS…
-
High 7.5
Cross-zone wildcard cache poisoning via RRSIG.labels manipulation
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a sin…
-
High 7.5
ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation
ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned s…
-
High 7.5
'dns-error-reporting: yes' leads to stack buffer overflow
In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain nam…
-
High 7.4
In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop befo…
-
High 7.0
libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling
Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.
-
Medium 6.8
Incorrect acceptance of NSEC3 records
BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through …
-
Medium 6.6
Another 'ghost domain names' attack variant
NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, a…
-
Medium 6.5
Key Record using PRIVATEDNS algorithm may lead to unexpected exit
If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorith…
-
Medium 6.5
BOGUS configured primary hostname accepted for XFR in auth/rpz zones
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record (no…
-
Medium 6.5
sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
-
Medium 6.5
ProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record Parser
ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64_MAX, which res…
-
Medium 6.5
Libxml2: libxml2: denial of service via crafted xsd-validated document
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, …
-
Medium 6.3
'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL
In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the s…
-
Medium 5.9
Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger and result in server termination and thus denial of service. W…
-
Medium 5.9
Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated
With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworker_alloc_cleanup…
-
Medium 5.9
Possible heap use-after-free in an error path when a DoT forwarded query is jostled out
In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostl…
-
Medium 5.9
Memory corruption could lead to crash and denial of service
In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled …
-
Medium 5.9
'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash
In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: <net> redirect' /'response-ip-data: <net> CNAME <target>' rule (or the RPZ 'rpz-cname-override' equivalent), a remote client who controls a…
-
Medium 5.9
Packet of death for a DNSCrypt misconfigured Unbound
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' …
-
Medium 5.9
Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal D…
-
Medium 5.9
Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration
In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logi…
-
Medium 5.9
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did no…
-
Medium 5.7
Possible cache poisoning attack by mapping source port population per thread
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome …
-
Medium 5.4
gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS sp…
-
Medium 5.3
'max-global-quota' reset by DNSSEC validation restarts
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-signed parent can cause Unbound to send more upstream packets per client query than the configured 'max-global-quota'. This effectively bypa…
-
Medium 5.3
Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush
In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries a…
-
Medium 4.8
Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name
In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and …
-
Medium 4.8
sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if t…
-
Medium 4.2
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is …
-
Medium 4.2
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs betwe…
-
Medium 4.2
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important…
-
Low 3.7
Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This result…
-
Low 3.7
Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records
In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A…
-
Low 3.7
Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN
In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be shadowed by the intermediate label's secure NXDOMAIN answer from the parent. This is caused by an …
-
Low 3.7
A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based…
-
Low 3.7
DNS Cookie bypass when combined with proxy-protocol use
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. …
-
Low 3.7
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive a…
-
Low 3.1
Privacy/configuration issue when adding local data in views through 'unbound-control'
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with…
-
Low 1.8
Stack-Based Buffer Overflow in libxml2
libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long inp…
Revision history
-
#1
Initiale Fassung
References
-
Meinberg Security Advisory MBGSA-2026.06 LANTIME-Firmware V7.10.014 vom 2026-08-26
http://news.meinberg.de/682/