Bug 426437 (CVE-2007-6341)

Summary:	CVE-2007-6341 Perl crash by crafted response to Net::DNS
Product:	[Other] Security Response	Reporter:	Lubomir Kundrak <lkundrak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	mmaslano, robin.norwood, wtogami
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6341
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-03-19 10:44:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Lubomir Kundrak 2007-12-20 23:41:44 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2007-6341 to the following vulnerability:

Net/DNS/RR/A.pm in Net::DNS 0.60 build 654, as used in packages such
as SpamAssassin and OTRS, allows remote attackers to cause a denial of
service (program "croak") via a crafted DNS response.

References:

http://www.securiteam.com/unixfocus/6I00E0UKKQ.html
https://rt.cpan.org/Public/Bug/Display.html?id=30316

Comment 1 Josh Bressers 2008-01-08 02:12:38 UTC

This issue has no security impact.  The flaw will cause Net::DNS to "croak",
which in turn should be handled by the calling application.  In the case of
RHEL, the only known application that uses this functionality is Spamassassin. 
Spamassassin handles this failure gracefully and continues to function, minus
the DNS tests.

Comment 2 Dick Franks 2008-02-13 18:10:28 UTC

This and similar vulnerabilities fixed in Net::DNS version 0.63.

Comment 3 Marcela Mašláňová 2008-03-19 09:10:17 UTC

Net::DNS version 0.63 is in rawhide.