CVE-2022-30256

An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for "Ghost" domain names.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.debian.org/debian-lts-announce/2023/06/msg00019.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3VSMLJX25MXGQ6A7UPOGK7VPUVDESPHL/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NB7LDZM5AGWC5BHHQHW6CP5OFNBBKFOQ/
https://maradns.samiam.org/	Product Vendor Advisory
https://maradns.samiam.org/security.html#CVE-2022-30256	Vendor Advisory
https://www.debian.org/security/2023/dsa-5441

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:maradns:maradns::::::::
	cpe:2.3:a:maradns:maradns::::::::

History

No history.

Information

Published : 2022-11-19 00:15

Updated : 2023-11-07 03:47

NVD link : CVE-2022-30256

Mitre link : CVE-2022-30256

CVE.ORG link : CVE-2022-30256

JSON object : View

Products Affected

maradns

maradns

CWE

CWE-672

Operation on a Resource after Expiration or Release

{"id": "CVE-2022-30256", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-11-19T00:15:10.497", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00019.html", "source": "cve@mitre.org"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3VSMLJX25MXGQ6A7UPOGK7VPUVDESPHL/", "source": "cve@mitre.org"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NB7LDZM5AGWC5BHHQHW6CP5OFNBBKFOQ/", "source": "cve@mitre.org"}, {"url": "https://maradns.samiam.org/", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://maradns.samiam.org/security.html#CVE-2022-30256", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.debian.org/security/2023/dsa-5441", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-672"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for \"Ghost\" domain names."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en MaraDNS Deadwood hasta 3.5.0021 que permite la variante V1 de resoluci\u00f3n de nombres de dominio no deseada. Un nombre de dominio revocado a\u00fan se puede resolver durante mucho tiempo, incluidos dominios caducados y dominios maliciosos eliminados. Los efectos de un exploit ser\u00edan generalizados y de gran impacto, porque la explotaci\u00f3n se ajusta a las especificaciones y pr\u00e1cticas operativas de DNS de facto, y supera los parches de mitigaci\u00f3n actuales para los nombres de dominio \"Ghost\""}], "lastModified": "2023-11-07T03:47:12.617", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:maradns:maradns:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "043E0914-15F6-4D95-AA7D-367C131CCE2B", "versionEndExcluding": "3.4.03"}, {"criteria": "cpe:2.3:a:maradns:maradns:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F46DBDE0-82CE-484D-8E75-0D6D61FEF83F", "versionEndExcluding": "3.5.0022", "versionStartIncluding": "3.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}