A critical eval injection vulnerability in the Net::DNS Perl module allows remote attackers to execute arbitrary code by supplying crafted EDNS payloads.

This is an eval injection (CWE-95) vulnerability located in the Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose function. The function improperly tokenizes raw bytes from the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option and passes them to Perl's eval without adequate sanitization, enabling command execution.

This vulnerability is critical, as it allows for arbitrary code execution on any system utilizing the vulnerable Net::DNS module to process DNS responses. Given the widespread use of this module in network-facing applications and services, the impact includes complete system compromise, data theft, and potential disruption of DNS-dependent services. The CVSS score of 9.8 reflects the high probability of successful remote exploitation without authentication.

Immediate Action: Upgrade the Net::DNS Perl module to version 1.56 or later to ensure the proper sanitization of input data.

Proactive Monitoring: Monitor systems for unexpected child processes or suspicious shell commands spawned by applications that utilize the Net::DNS library.

Compensating Controls: Use network-level filtering to drop malformed DNS responses or those containing unusual character sequences in the EXTRA-TEXT field if an immediate patch is not feasible.

Public Exploit Available: Yes, a public exploit exists.

The severity of this remote code execution vulnerability necessitates an immediate audit of all environments running Perl-based DNS services. Administrators must upgrade to version 1.56 or later to mitigate the risk of command injection. Delaying this patch could allow attackers to gain persistent access to critical network infrastructure.