CVE-2016-10152

Name	CVE-2016-10152
Description	The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-796-1
Debian Bugs	852093

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
hesiod (PTS)	bullseye	3.2.1-3.1	fixed
	bookworm	3.2.1-4	fixed
	forky, sid, trixie	3.2.1-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
hesiod	source	wheezy	3.0.2-21+deb7u1		DLA-796-1
hesiod	source	(unstable)	3.2.1-3.1	low		852093

Notes

[stretch] - hesiod <no-dsa> (Minor issue)
[jessie] - hesiod <no-dsa> (Minor issue)
https://github.com/achernya/hesiod/pull/10
https://bugzilla.redhat.com/show_bug.cgi?id=1332493