Description
The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via crafted zone data for this subdomain.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | djbdns | 1:1.05-5 | — |
| Debian 13 | djbdns | 1:1.05-5 | — |
| Debian 12 | djbdns | 1:1.05-5 | — |
| Debian 5.0 | djbdns | 1:1.05-4+lenny1 | DSA-1831-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- djbdns 1.05 - Long Response Packet Remote Cache Poisoning EDB-32825 · remote · Feb 27, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-1831-1 djbdns - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- 35820 third-party-advisory
- 20090228 Re: djbdns misformats some long response packets; patch and example attack mailing-list
- djbdns-response-packet-spoofing(49003) vdb-entry
- 20090305 Re: djbdns misformats some long response packets; patch and example attack mailing-list
- http://securityandthe.net/2009/03/05/security-issue-in-djbdns-confirmed/
- DSA-1831 vendor-advisory
- [dns] 20090304 djbdns<=1.05 lets AXFRed subdomains overwrite domains mailing-list
- 33937 vdb-entry
- 20090226 djbdns misformats some long response packets; patch and example attack mailing-list
- [dns] 20090225 djbdns misformats some long response packets; patch and example mailing-list
- http://it.slashdot.org/article.pl?sid=09/03/05/2014249