CVE-2022-30258

An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for "Ghost" domain names.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-81	Release Notes Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:technitium:dns_server:*:*:*:*:*:*:*:*

History

28 Nov 2022, 17:53

Type	Values Removed	Values Added
References	~~(MISC) https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-81 -~~	(MISC) https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-81 - Release Notes, Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
CWE		CWE-706
First Time		Technitium dns Server Technitium
CPE		cpe:2.3:a:technitium:dns_server::::::::

22 Nov 2022, 13:44

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-11-21 22:15

Updated : 2023-12-10 14:48

NVD link : CVE-2022-30258

Mitre link : CVE-2022-30258

CVE.ORG link : CVE-2022-30258

JSON object : View

Products Affected

technitium

dns_server

CWE

CWE-706

Use of Incorrectly-Resolved Name or Reference

{"id": "CVE-2022-30258", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-11-21T22:15:12.110", "references": [{"url": "https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-81", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-706"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and highly impactful, because the exploitation conforms to de facto DNS specifications and operational practices, and overcomes current mitigation patches for \"Ghost\" domain names."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Technitium DNS Server hasta 8.0.2 que permite la variante V2 de resoluci\u00f3n de nombres de dominio no deseada. Un nombre de dominio revocado a\u00fan se puede resolver durante mucho tiempo, incluidos dominios caducados y dominios maliciosos eliminados. Los efectos de un exploit ser\u00edan generalizados y de gran impacto, porque la explotaci\u00f3n se ajusta a las especificaciones y pr\u00e1cticas operativas de DNS de facto, y supera los parches de mitigaci\u00f3n actuales para los nombres de dominio \"Ghost\"."}], "lastModified": "2022-11-28T17:53:31.763", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:technitium:dns_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F68D4A2-5C6A-4A2A-97F7-722B6FC4C661", "versionEndIncluding": "8.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}