Ubuntu 22.10: 5907-1 Serious Risk of c-ares Denial Of Service Attack

ubuntu

March 2, 2023

c-ares could be made to crash or run programs if it processed specially crafted input.

Summary

c-ares could be made to crash or run programs if it processed specially

crafted input.

Software Description:

- c-ares: library for asynchronous name resolution

Details:

It was discovered that c-ares incorrectly handled certain sortlist strings.

A remote attacker could use this issue to cause c-ares to crash, resulting

in a denial of service, or possibly execute arbitrary code.

Topics Covered

security advisory denial of service software update ubuntu attack risk input processing c-ares

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   libc-ares2                      1.18.1-1ubuntu0.22.10.1

Ubuntu 22.04 LTS:
   libc-ares2                      1.18.1-1ubuntu0.22.04.1

Ubuntu 20.04 LTS:
   libc-ares2                      1.15.0-1ubuntu0.2

Ubuntu 18.04 LTS:
   libc-ares2                      1.14.0-1ubuntu0.2

In general, a standard system update will make all the necessary changes.