CVE-2016-10152

Critical

Published: 28/03/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 defaults to the '.athena.mit.edu' domain when opening the configuration file fails, allowing remote attackers to gain root privileges by poisoning the DNS cache.

Risk Assessment

Attackers can exploit this vulnerability to gain control over the system, posing a serious security threat to the organization.

Recommendation

It is recommended to update to the latest version of Hesiod and to monitor and secure the DNS cache against potential attacks.

Original NVD description (English source)

The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.