CVE-2007-6341: net_dns

CVSS: 5.0v2.0MediumModified

AliasesDEBIAN-CVE-2007-6341

Published 20-12-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-6341 is a medium (CVSS 5.0) vulnerability in net_dns. EPSS estimates a 9.55% chance of exploitation in the next 30 days, higher than 95.4% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk

32/100

0100

Medium · default modelHow is this calculated?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

9.55%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits4reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 1

DSA-1515-1

Timeline

20-12-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Net/DNS/RR/A.pm in Net::DNS 0.60 build 654, as used in packages such as SpamAssassin and OTRS, allows remote attackers to cause a denial of service (program "croak") via a crafted DNS response.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

9.55%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 9.55% on 19-09-2026

19-09-202619-10-2026

EPSS score

9.55%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found

referenceUnverified
Exploit Reference (rt.cpan.org)
Maturity: unknown
referenceUnverified
Exploit Reference (securiteam.com)
Maturity: unknown
referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown

Show all 4 exploits

exploit-databasedoslinuxVerified
Perl Net::DNS 0.48/0.59/0.60 - DNS Response Remote Denial of Service
Maturity: poc

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Debian1 product

libnet-dns-perl< 0.63-1

Net_dns1 product

net_dns0.60:build_654

2 vendors · 2 products

References

13 links

secunia.com/advisories/29354Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id?1019104VDB EntryX Refsource SECTRACK
search.cpan.org/src/OLAF/Net-DNS-0.63/ChangesX Refsource CONFIRM
secunia.com/advisories/29555Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1515Vendor AdvisoryX Refsource DEBIAN
rt.cpan.org/Public/Bug/Display.html?id=30316X Refsource MISCExploit
www.securiteam.com/unixfocus/6I00E0UKKQ.htmlX Refsource MISCExploit
secunia.com/advisories/29343Third Party AdvisoryX Refsource SECUNIA
usn.ubuntu.com/594-1/Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/29446Third Party AdvisoryX Refsource SECUNIA

Show all 13 references

www.mandriva.com/security/advisories?name=MDVSA-2008:073Vendor AdvisoryX Refsource MANDRIVA
www.securityfocus.com/bid/26902VDB EntryX Refsource BIDExploit
security-tracker.debian.org/tracker/CVE-2007-6341Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities