CVE-2016-10152
hesiod: The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when...
CVE-2016-10152 is fixed in 2 products on 1 platform, first by hesiod 3.2.1-3.1~build0.18.04.1, released March 28, 2017. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Negligible
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0683
94th percentile
The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| hesiod · Ubuntu 18.04.6 LTS (bionic) | 3.2.1-3.1~build0.18.04.1 | hesiod 3.2.1-3.1~build0.18.04.1 | Mar 28, 2017 |
| libhesiod0 · Ubuntu 18.04.6 LTS (bionic) | 3.2.1-3.1~build0.18.04.1 | libhesiod0 3.2.1-3.1~build0.18.04.1 | Mar 28, 2017 |