CVE-2012-1570

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-03-28 · updated 2026-06-16

Description

The resolver in MaraDNS before 1.3.0.7.15 and 1.4.x before 1.4.12 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.

Affected products

MaraDNS: before 1.3.07.15; from 1.4.0 before 1.4.12 — fixed in 1.3.07.15, 1.4.12

How to fix

Upgrade to a fixed version: MaraDNS 1.3.07.15, 1.4.12. Check the vendor advisory for mitigations.

References

http://osvdb.org/80192
http://secunia.com/advisories/48492
http://www.maradns.org/changelog.html
http://www.openwall.com/lists/oss-security/2012/03/20/1
http://www.openwall.com/lists/oss-security/2012/03/20/10
http://www.securitytracker.com/id?1026821
https://bugzilla.redhat.com/show_bug.cgi?id=804770
https://exchange.xforce.ibmcloud.com/vulnerabilities/74119
http://osvdb.org/80192
http://secunia.com/advisories/48492
http://www.maradns.org/changelog.html
http://www.openwall.com/lists/oss-security/2012/03/20/1

Get alerted when CVE-2012-1570 or the next vulnerability affects your stack