Critical severity9.8NVD Advisory· Published Mar 28, 2017· Updated Jun 17, 2026

CVE-2016-10152

Description

The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Hesiod/Hesiod2 versions
cpe:2.3:a:hesiod_project:hesiod:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:hesiod_project:hesiod:*:*:*:*:*:*:*:*range: <=3.2.1
- (no CPE)range: =3.2.1

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2017/01/21/1nvdMailing ListPatchThird Party Advisory
github.com/achernya/hesiod/pull/10nvdIssue TrackingPatchThird Party Advisory
www.securityfocus.com/bid/90952nvdThird Party AdvisoryVDB Entry
bugzilla.redhat.com/show_bug.cginvdIssue Tracking
security.gentoo.org/glsa/201805-01nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.005
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000