MaraDNS is "a package that implements the Domain Name Service (DNS), an essential internet service". Two denial of service vulnerabilities have been found in MaraDNS, one is related to recursive requests, while the other is related to the use of non-Internet class records.
Credit:
The information has been provided by Joao Antunes.
Vulnerable Systems:
* MaraDNS version 1.2.12.05
* MaraDNS version 1.3.04
Immune Systems:
* MaraDNS version 1.2.12.06
* MaraDNS version 1.3.05
MaraDNS are prone to local resource exhaustion vulnerabilities susceptible of causing a denial of service. DNS requests for reverse lookups (opcode != 0) or non-Internet class records (qclass != 1) queries will cause the server to leak approximately 550 bytes of memory. This can be exploited by a remote attacker to cause MaraDNS to allocate an arbitrary large amount of memory, thus provoking a remote denial of service when exhausting all the available memory.
