[ASA-202108-13] c-ares: insufficient validation
Jonas Witschel
diabonas at archlinux.org
Fri Aug 13 18:07:38 UTC 2021
Arch Linux Security Advisory ASA-202108-13
==========================================
Severity: Medium
Date : 2021-08-10
CVE-ID : CVE-2021-3672
Package : c-ares
Type : insufficient validation
Remote : Yes
Link : https://security.archlinux.org/AVG-2268
Summary
=======
The package c-ares before version 1.17.2-1 is vulnerable to
insufficient validation.
Resolution
==========
Upgrade to 1.17.2-1.
# pacman -Syu "c-ares>=1.17.2-1"
The problem has been fixed upstream in version 1.17.2.
Workaround
==========
None.
Description
===========
Missing input validation of host names returned by Domain Name Servers
in the c-ares library before version 1.17.2 can lead to output of wrong
hostnames (leading to domain hijacking).
Impact
======
A remote attacker with the ability to create DNS entries could create
crafted entries that output the wrong hostname when resolved with
c-ares, leading to potential domain hijacking.
References
==========
https://c-ares.haxx.se/adv_20210810.html
https://github.com/c-ares/c-ares/commit/362f91d807d293791008cdb7616d40f7784ece83
https://github.com/c-ares/c-ares/commit/44c009b8e62ea1929de68e3f438181bea469ec14
https://security.archlinux.org/CVE-2021-3672
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210813/b8f687a6/attachment-0001.sig>
More information about the arch-security
mailing list