Secunia

Two vulnerabilities have been reported in the Net::DNS Perl module, which can be exploited to poison the DNS cache or to cause a DoS (Denial of Service).

1) An error exists in the handling of DNS queries where IDs are incremented with a fixed value and are additionally used for child processes in a forking server. This can be exploited to poison the DNS cache of an application using the module if a valid ID is guessed.

2) An error in the PP implementation within the "dn_expand()" function can be exploited to cause a stack overflow due to an endless loop via a specially crafted DNS packet.

The vulnerabilities are reported in versions prior to 0.60.

Solution
Update to version 0.60.

Provided and/or discovered by
The vendor credits:
1) hjp
2) Steffen Ullrich

Original Advisory
http://www.net-dns.org/docs/Changes.html
http://rt.cpan.org/Public/Bug/Display.html?id=23961
http://rt.cpan.org/Public/Bug/Display.html?id=27285

Deep Links
Links available in Customer Area