CVE-2016-7069

Name of the Vulnerable Software and Affected Versions dnsdist versions prior to 1.2.0

Description The issue arises from the handling of EDNS0 OPT records when parsing responses from a backend in dnsdist. Specifically, when dnsdist is configured to add EDNS Client Subnet to a query, it may receive a response containing an EDNS0 OPT record that needs to be removed before forwarding the response to the client. On 32-bit systems, the pointer arithmetic used to remove this record can trigger undefined behavior, leading to a crash.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue.