Vulnerability Note VU#186131

Blahz-DNS does not properly authenticate users before granting access to various configuration pages

Overview

Blahz-DNS does not properly authenticate users.

I. Description

Blahz-DNS does not properly authenticate users. As a result, an attacker can gain access to various configuration pages. For more detailed information, please see the ppp-design advisory.

II. Impact

An attacker can gain access to various configuration pages and make modifications to DNS information.

III. Solution

Upgrade to version to .25.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Mike Roest	Vulnerable	2-May-2002

References

http://blahzdns.sourceforge.net
http://www.ppp-design.de/advisories.php
http://www.securityfocus.com/bid/4618
http://www.iss.net/security_center/static/8951.php
http://sourceforge.net/project/shownotes.php?release_id=87004
http://archives.neohapsis.com/archives/bugtraq/2002-04/0395.html

Credit

Thanks to ppp-design for reporting this vulnerability.

This document was written by Ian A. Finlay.

Other Information

Date Public:	2002-04-29
Date First Published:	2003-03-21
Date Last Updated:	2003-03-21
CERT Advisory:
CVE-ID(s):	CAN-2002-0599
NVD-ID(s):	CAN-2002-0599
US-CERT Technical Alerts:
Metric:	16.54
Document Revision:	10

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader