[VIM] Old DNS issues from May 2005 missed by most

[Steven M. Christey]

The following CVE's were only just updated, even though they're almost
a year old.  Most vuln DB's didn't catch the details, and no wonder...

The original disclosure was by NISCC and had no vendor/product details
at all.  I had left the CVEs blank, waiting for more public
information, and it must have just fallen off my plate.  While dealing
with the recent DNS issues, I ran across these old ones.  A Google
search for "CAN-2005-0036" (0ld sk00l r0x!) and whattaya know, there's
a PDF floating around.  Nothing like using Google to find out what
your own identifier is actually about :)

Major nit: NISCC really needs to make a clearer link between the HTML
and PDF files.  Like, actually linking to the PDF from the HTML.

- Steve

======================================================
Name: CVE-2005-0036
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0036
Reference: MISC:http://www.niscc.gov.uk/niscc/docs/re-20050524-00432.pdf?lang=en
Reference: MISC:http://www.niscc.gov.uk/niscc/docs/al-20050524-00433.html
Reference: BID:13729
Reference: URL:http://www.securityfocus.com/bid/13729

The DNS implementation in DeleGate 8.10.2 and earlier allows remote
attackers to cause a denial of service via a compressed DNS packet
with a label length byte with an incorrect offset, which could trigger
an infinite loop.


======================================================
Name: CVE-2005-0037
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0037
Reference: MISC:http://www.niscc.gov.uk/niscc/docs/re-20050524-00432.pdf?lang=en
Reference: MISC:http://www.niscc.gov.uk/niscc/docs/al-20050524-00433.html
Reference: BID:13729
Reference: URL:http://www.securityfocus.com/bid/13729

The DNS implementation of DNRD before 2.10 allows remote attackers to
cause a denial of service via a compressed DNS packet with a label
length byte with an incorrect offset, which could trigger an infinite
loop.


======================================================
Name: CVE-2005-0038
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0038
Reference: MISC:http://www.niscc.gov.uk/niscc/docs/re-20050524-00432.pdf?lang=en
Reference: MISC:http://www.niscc.gov.uk/niscc/docs/al-20050524-00433.html
Reference: BID:13729
Reference: URL:http://www.securityfocus.com/bid/13729

The DNS implementation of PowerDNS 2.9.16 and earlier allows remote
attackers to cause a denial of service via a compressed DNS packet
with a label length byte with an incorrect offset, which could trigger
an infinite loop.