Secunia

Roy Arends and Jakob Schlyter has reported a vulnerability in various Axis products, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a design error within the DNS protocol implementation, which allows a DNS response to be answered with a DNS response. This can be exploited by sending a DNS request (either spoofed to originate from port 53/UDP on another vulnerable device or from the device itself) to a vulnerable device, which will cause DNS messages to bounce back and forth in an infinite loop.

Successful exploitation may consume a large amount of system and network resources.

The vulnerability affects the following products:
* Axis 2400+ Network Video Server
* Axis 2401+ Network Video Server
* Axis 2460 Network DVR
* Axis 2100 Network Camera
* Axis 2110 Network Camera
* Axis 2120 Network Camera
* Axis 2420 Network Camera

Solution
Updated firmware releases are available at:
Further details available in Customer Area

Provided and/or discovered by
Roy Arends and Jakob Schlyter

Original Advisory
NISCC:
http://www.uniras.gov.uk/vuls/2004/758884/index.htm

Deep Links
Links available in Customer Area