ArchLinux: 202108-13: c-ares: insufficient validation

Advisories

Arch Linux Security Advisory ASA-202108-13
==========================================

Severity: Medium
Date    : 2021-08-10
CVE-ID  : CVE-2021-3672
Package : c-ares
Type    : insufficient validation
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2268

Summary
=======

The package c-ares before version 1.17.2-1 is vulnerable to
insufficient validation.

Resolution
==========

Upgrade to 1.17.2-1.

# pacman -Syu "c-ares>=1.17.2-1"

The problem has been fixed upstream in version 1.17.2.

Workaround
==========

None.

Description
===========

Missing input validation of host names returned by Domain Name Servers
in the c-ares library before version 1.17.2 can lead to output of wrong
hostnames (leading to domain hijacking).

Impact
======

A remote attacker with the ability to create DNS entries could create
crafted entries that output the wrong hostname when resolved with
c-ares, leading to potential domain hijacking.

References
==========

https://c-ares.haxx.se/adv_20210810.html
https://github.com/c-ares/c-ares/commit/362f91d807d293791008cdb7616d40f7784ece83
https://github.com/c-ares/c-ares/commit/44c009b8e62ea1929de68e3f438181bea469ec14
https://security.archlinux.org/CVE-2021-3672

ArchLinux: 202108-13: c-ares: insufficient validation

August 13, 2021
The package c-ares before version 1.17.2-1 is vulnerable to insufficient validation

Summary

Missing input validation of host names returned by Domain Name Servers in the c-ares library before version 1.17.2 can lead to output of wrong hostnames (leading to domain hijacking).

Resolution

Upgrade to 1.17.2-1.
# pacman -Syu "c-ares>=1.17.2-1"
The problem has been fixed upstream in version 1.17.2.

References

https://c-ares.haxx.se/adv_20210810.html https://github.com/c-ares/c-ares/commit/362f91d807d293791008cdb7616d40f7784ece83 https://github.com/c-ares/c-ares/commit/44c009b8e62ea1929de68e3f438181bea469ec14 https://security.archlinux.org/CVE-2021-3672

Severity
CVE-ID : CVE-2021-3672
Package : c-ares
Type : insufficient validation
Remote : Yes
Link : https://security.archlinux.org/AVG-2268

Impact

A remote attacker with the ability to create DNS entries could create crafted entries that output the wrong hostname when resolved with c-ares, leading to potential domain hijacking.

Workaround

None.

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.