Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 534
Alerts This Week
Warning Icon 1 534

Ubuntu 16.04 ESM: USN-5034-2 Severe: c-ares Domain Manipulation

ubuntu
Calendar Grey August 10, 2021
Dist Ubuntu Esm H88
Ubuntu Security Notice USN-5045-3 addresses OpenSSL vulnerabilities leading to improper data handling impacting local security.
c-ares could be made to return wrong domains.

Summary

c-ares could be made to return wrong domains.

Software Description:

- c-ares: library for asynchronous name resolution

Details:

USN-5034-1 fixed a vulnerability in c-ares. This update provides

the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

Philipp Jeitner and Haya Shulman discovered that c-ares incorrectly

validated certain hostnames returned by DNS servers. A remote attacker

could possibly use this issue to perform Domain Hijacking attacks.

Topics%20covered

Topics Covered

security advisory critical threat ubuntu domain hijacking c-ares

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 ESM:
  libc-ares2                      1.10.0-3ubuntu0.2+esm1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5034-2

https://ubuntu.com/security/notices/USN-5034-1

CVE-2021-3672

Severity
critical
Lowest
Low
Medium
High
Critical

August 10, 2021

Topics%20covered

Topics Covered

security advisory critical threat ubuntu domain hijacking c-ares

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.