CVE-2007-3409

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-06-26 · updated 2026-06-16
Weakness: CWE-674

Description

Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.

Affected products

Canonical Ubuntu Linux: 6.06, 6.10
Debian Linux: 3.1, 4.0
Net-Dns Net::Dns: before 0.60 — fixed in 0.60

How to fix

Upgrade to a fixed version: Net-Dns Net::Dns 0.60. Check the vendor advisory for mitigations.

References

http://osvdb.org/37054
http://rt.cpan.org/Public/Bug/Display.html?id=27285
http://secunia.com/advisories/25829
http://secunia.com/advisories/26012
http://secunia.com/advisories/26014
http://secunia.com/advisories/26055
http://secunia.com/advisories/26075
http://secunia.com/advisories/26211
http://secunia.com/advisories/26231
http://secunia.com/advisories/26417
http://secunia.com/advisories/26543

Get alerted when CVE-2007-3409 or the next vulnerability affects your stack