UBUNTU-CVE-2016-10152

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2016-10152

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-10152.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2016-10152

Upstream

CVE-2016-10152

Published

2017-03-28T14:59:00Z

Modified

2026-04-22T10:29:42.857903Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Ubuntu - negligible

Summary

[none]

Details

The readconfigfile function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.

References

Affected packages

Ubuntu:16.04:LTS / hesiod

Package

Name: hesiod
Purl: pkg:deb/ubuntu/hesiod@3.2.1-3.1~build0.16.04.1?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.2.1-3.1~build0.16.04.1

Affected versions

3.*

3.2.1-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "hesiod",
            "binary_version": "3.2.1-3.1~build0.16.04.1"
        },
        {
            "binary_name": "libhesiod0",
            "binary_version": "3.2.1-3.1~build0.16.04.1"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-10152.json"

Ubuntu:18.04:LTS / hesiod