Arch Linux Security Advisory ASA-202004-24 ========================================== Severity: Critical Date : 2020-04-30 CVE-ID : CVE-2020-6071 CVE-2020-6072 CVE-2020-6073 CVE-2020-6077 CVE-2020-6078 CVE-2020-6079 CVE-2020-6080 Package : libmicrodns Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1136 Summary ======= The package libmicrodns before version 0.1.2-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 0.1.2-1. # pacman -Syu "libmicrodns>=0.1.2-1" The problems have been fixed upstream in version 0.1.2. Workaround ========== None. Description =========== - CVE-2020-6071 (denial of service) An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is followed without checking for recursion, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability. - CVE-2020-6072 (arbitrary code execution) An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the rr_decode function's return value is not checked, leading to a double free that could be exploited to execute arbitrary code. An attacker can send an mDNS message to trigger this vulnerability. - CVE-2020-6073 (information disclosure) An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing the RDATA section in a TXT record in mDNS messages, multiple integer overflows can be triggered, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability. - CVE-2020-6077 (information disclosure) An exploitable denial-of-service vulnerability exists in the message- parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages, the implementation does not properly keep track of the available data in the message, possibly leading to an out-of-bounds read that would result in a denial of service. An attacker can send an mDNS message to trigger this vulnerability. - CVE-2020-6078 (denial of service) An exploitable denial-of-service vulnerability exists in the message- parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages in mdns_recv, the return value of the mdns_read_header function is not checked, leading to an uninitialized variable usage that eventually results in a null pointer dereference, leading to service crash. An attacker can send a series of mDNS messages to trigger this vulnerability. - CVE-2020-6079 (denial of service) Multiple exploitable denial-of-service vulnerabilities exist in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger these vulnerabilities. - CVE-2020-6080 (denial of service) Multiple exploitable denial-of-service vulnerabilities exist in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger these vulnerabilities. Impact ====== A remote attacker can provide crafted DNS responses to crash the service, disclose data or execute arbitrary code. References ========== https://github.com/videolabs/libmicrodns/releases/tag/0.1.1 https://talosintelligence.com/vulnerability_reports/TALOS-2020-0994 https://github.com/videolabs/libmicrodns/commit/0103f40371cd6e5f034d1ea5674c... https://talosintelligence.com/vulnerability_reports/TALOS-2020-0995 https://github.com/videolabs/libmicrodns/commit/219b180c3cea9ad674a5512412fb... https://talosintelligence.com/vulnerability_reports/TALOS-2020-0996 https://github.com/videolabs/libmicrodns/commit/f0e8a723ef2d0a7ef9e200a8fd7c... https://talosintelligence.com/vulnerability_reports/TALOS-2020-1000 https://github.com/videolabs/libmicrodns/commit/80860fad7e046959b730a0e37fd8... https://talosintelligence.com/vulnerability_reports/TALOS-2020-1001 https://github.com/videolabs/libmicrodns/commit/4fb18284bea9a4f5eaf7745d7296... https://talosintelligence.com/vulnerability_reports/TALOS-2020-1002 https://github.com/videolabs/libmicrodns/commit/9768bdbeb8ea6b7849a97af4362d... https://security.archlinux.org/CVE-2020-6071 https://security.archlinux.org/CVE-2020-6072 https://security.archlinux.org/CVE-2020-6073 https://security.archlinux.org/CVE-2020-6077 https://security.archlinux.org/CVE-2020-6078 https://security.archlinux.org/CVE-2020-6079 https://security.archlinux.org/CVE-2020-6080