CVE-2007-3409
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack...
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.
- Record
CVE-2007-3409- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-674
- Updated
- 2026-11-02
CVE List
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.
- Record
CVE-2007-3409- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
EUVDEUVD-2007-3395
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.
- Record
EUVD-2007-3395- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vf3x-8mv3-rv64 No score
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack...
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.
- Record
GHSA-vf3x-8mv3-rv64- Updated
- 2026-11-02
OSV
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.
- Record
CVE-2007-3409- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-3409
Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.
- Record
DEBIAN-CVE-2007-3409- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libnet-dns-perlDebian:12 |
before 0.60-1 | 0.60-1 |
libnet-dns-perlDebian:13 |
before 0.60-1 | 0.60-1 |
libnet-dns-perlDebian:14 |
before 0.60-1 | 0.60-1 |
libnet-dns-perlDebian:3.1 From an advisory covering 3 CVEs |
before 0.48-1sarge1, plus listed versions 0.48-1 |
0.48-1sarge1 |
libnet-dns-perlDebian:4.0 From an advisory covering 3 CVEs |
before 0.59-1etch1, plus listed versions 0.59-1 |
0.59-1etch1 |
perl-Net-DNSRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:0.31-4.el3 | 0:0.31-4.el3 |
perl-Net-DNSRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:0.31-4.el3 | 0:0.31-4.el3 |
perl-Net-DNSRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:0.31-4.el3 | 0:0.31-4.el3 |
perl-Net-DNSRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:0.31-4.el3 | 0:0.31-4.el3 |
perl-Net-DNSRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:0.59-3.el5 | 0:0.59-3.el5 |
perl-Net-DNS-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:0.59-3.el5 | 0:0.59-3.el5 |
perl-Net-DNSRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:0.59-3.el5 | 0:0.59-3.el5 |
perl-Net-DNS-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:0.59-3.el5 | 0:0.59-3.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3409 is a high vulnerability (CVSS 7.5) in Canonical Ubuntu Linux, published June 26, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.49%, the 89th percentile. Fixed in libnet-dns-perl 0.60-1.
References
secunia.com/advisories/26231
rt.cpan.org/Public/Bug/Display.html?id=27285
Show 31 moreShow less
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10595
debian.org/security/2008/dsa-1515
net-dns.org/docs/Changes.html
securitytracker.com/id?1018376
novell.com/linux/security/advisories/2007_17_sr.html
ubuntu.com/usn/usn-483-1
trustix.org/errata/2007/0023
mandriva.com/security/advisories?name=MDKSA-2007:146
redhat.com/support/errata/RHSA-2007-0674.html
securityfocus.com/bid/24669
osvdb.org/37054
gentoo.org/security/en/glsa/glsa-200708-06.xml
nvd.nist.gov/vuln/detail/CVE-2007-3409
github.com/advisories/GHSA-vf3x-8mv3-rv64
security-tracker.debian.org/tracker/CVE-2007-3409
access.redhat.com/errata/RHSA-2007:0674
bugzilla.redhat.com/show_bug.cgi?id=245466
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0674.json
cve.org/CVERecord?id=CVE-2007-3377