Unintended Domain Name Resolution in Technitium DNS Server
CVE-2022-30257

9.8CRITICAL

Key Information:

Vendor

Technitium

Status
Dns Server
Vendor
CVE Published:
21 November 2022

What is CVE-2022-30257?

A vulnerability identified in Technitium DNS Server versions up to 8.0.2 permits unintended domain name resolution, which allows revoked and expired domains to be accessible for an extended duration. This can result in the resolution of domains that should no longer be active, including those associated with malicious activities. The implications are severe as this vulnerability adheres to standard DNS specifications and circumvents existing mitigation efforts aimed at addressing 'Ghost' domains.

References

https://github.com/TechnitiumSoftware/DnsServer/blob/mast...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.