Description
Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, as derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.2.5-8 | — |
| Debian 13 | glibc | 2.2.5-8 | — |
| Debian 12 | glibc | 2.2.5-8 | — |
References
- CLSA-2002:507 vendor-advisory
- RHSA-2002:139 vendor-advisory
- ESA-20020724-018 vendor-advisory
- oval:org.mitre.oval:def:4190 vdb-entry signature
- 20020626 Remote buffer overflow in resolver code of libc mailing-list
- RHSA-2002:119 vendor-advisory
- VU#803539 third-party-advisory
- dns-resolver-lib-bo(9432) vdb-entry
- MDKSA-2002:038 vendor-advisory
- IY32719 vendor-advisory
- RHSA-2002:167 vendor-advisory
- RHSA-2003:154 vendor-advisory
- 20020703 Buffer overflow and DoS i BIND mailing-list
- 20020704 [OpenPKG-SA-2002.006] OpenPKG Security Advisory (bind) mailing-list
- MDKSA-2002:043 vendor-advisory
- RHSA-2002:133 vendor-advisory
- FreeBSD-SA-02:28 vendor-advisory
- CA-2002-19 third-party-advisory
- 5100 vdb-entry
- http://www.pine.nl/advisories/pine-cert-20020601.txt