Description
The DNSSEC validation library (libval) library in dnssec-tools before 1.3.1 does not properly check that the signing key is the APEX trust anchor, which might allow attackers to conduct unspecified attacks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://secunia.com/advisories/29095 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/40836 ↗
- http://www.vupen.com/english/advisories/2008/0673/references ↗
- http://sourceforge.net/mailarchive/forum.php?thread_name=sdlk5lolzj.fsf%40wes.hardakers.net&forum_name=dnssec-tools-users ↗
- http://secunia.com/advisories/29127 ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00820.html ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00845.html ↗
- http://www.securityfocus.com/bid/27998 ↗