It was reported that hesiod uses hard-coded default domain name allowing the attacker, that can control the athena.mit.edu zone or one of its parent zones or able to pose as MITM, to supply fake Hesiod data in certain cases, allowing injection of fake root accounts. If Hesiod deployment uses DNSSEC with a trusted, validating recursive resolver to secure Hesiod data, it can result into retrieval of non-DNSSEC-signed Hesiod data, since athena.mit.edu is currently unsigned.

Vulnerable code:

#define DEF_RHS ".athena.mit.edu"
...
/* Try to open the configuration file. */
fp = fopen(filename, "r");
if (!fp)
{
/* Use compiled in default domain names. */
ctx->lhs = malloc(strlen(DEF_LHS) + 1);
ctx->rhs = malloc(strlen(DEF_RHS) + 1);