CVE-2014-2031

Vulnerability

A logic error in Deadwood (the recursive DNS resolver used in MaraDNS) causes an out-of-bounds read when processing certain DNS queries. The bug exists in Deadwood versions before 2.3.09 and 3.x before 3.2.05, and consequently in MaraDNS versions before 1.4.14 and 2.x before 2.0.09 [1][2]. The flaw is in the code that handles recursive queries; specifically, a logic error makes it "make no sense to add begin and obj->len" [3], leading to an incorrect bounds check.

Exploitation

An attacker must have permission to perform recursive queries against a vulnerable Deadwood instance. By sending a specially crafted DNS query, the attacker triggers the logic error, causing an out-of-bounds read that results in a crash [2]. No authentication is required beyond the ability to send recursive queries.

Impact

Successful exploitation causes a denial of service (DoS) via crash of the Deadwood process, disrupting DNS resolution for legitimate users. The impact is limited to availability; no code execution or data disclosure is indicated.

Mitigation

The vulnerability is fixed in Deadwood 2.3.09 and 3.2.05, and in MaraDNS 1.4.14 and 2.0.09 [1]. Users should upgrade to these versions or later. No workaround is documented. MaraDNS 1.x is end-of-life as of June 21, 2015 [1]. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.