MaraDNS 1.0 before 1.0.41, 1.2 before 1.2.12.08, and 1.3 before 1.3.07.04
allows remote attackers to cause a denial of service via a crafted DNS
packet that prevents an authoritative name (CNAME) record from resolving,
aka "improper rotation of resource records."