CVE-2002-1146

NameCVE-2002-1146
DescriptionThe BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, use the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
glibc (PTS)jessie2.19-18+deb8u7fixed
jessie (security)2.19-18+deb8u3fixed
stretch, sid2.24-9fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
bindsource(unstable)1:8.3.3medium
glibcsource(unstable)2.3medium

Notes

see http://www.kb.cert.org/vuls/id/AAMN-5D28K6 (glibc)
see http://www.kb.cert.org/vuls/id/AAMN-5D287U (bind)

Search for package or bug name: Reporting problems