The nscd service in the GNU C Library 2.3.4 onwards may crash due to a
\nstack overflow when a malicious DNS server returns too large a response
\nfor a DNS query, resulting in degraded DNS resolution for the system.<\/p>\n
Exploitation of this bug needs a system that has nscd enabled and using
\nan untrusted DNS server for name resolution, with the compromised DNS
\nserver being capable of processing records large enough to result in a
\nstack overflow in an nscd thread stack.\u00a0 During experimentation, bind 9
\nwas unable to handle large records, but that could change in future or
\nwith a different name server.\u00a0 In typical installations, nscd is
\nexecuted in an isolated context as its own user without a shell, due to
\nwhich any compromise of that service is isolated.<\/p>\n
There is a remote possibility of nscd cache corruption if an attacker
\nmanages to get the stack pointer into a desired point in the heap,
\npotentially resulting in other caches in nscd being overwritten with
\ncorrupt data through the stack overflow, until the buggy code path
\neventually results in a crash.<\/p>\n
Finally, a crash in nscd may result in performance degradation when
\nresolving names, but it does not result in a denial of service.<\/p>\n","protected":false},"excerpt":{"rendered":"
The nscd service in the GNU C Library 2.3.4 onwards may crash due to a
\nstack overflow when a malicious DNS server returns too large a response
\nfor a DNS query, resulting in degraded DNS resolution f<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-20918","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/20918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=20918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=20918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=20918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}