Lucene search

K
archlinuxArchLinuxASA-202108-13
HistoryAug 10, 2021 - 12:00 a.m.

[ASA-202108-13] c-ares: insufficient validation

2021-08-1000:00:00
security.archlinux.org
112

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

5.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

0.002

Percentile

52.8%

Arch Linux Security Advisory ASA-202108-13

Severity: Medium
Date : 2021-08-10
CVE-ID : CVE-2021-3672
Package : c-ares
Type : insufficient validation
Remote : Yes
Link : https://security.archlinux.org/AVG-2268

Summary

The package c-ares before version 1.17.2-1 is vulnerable to
insufficient validation.

Resolution

Upgrade to 1.17.2-1.

pacman -Syu “c-ares>=1.17.2-1”

The problem has been fixed upstream in version 1.17.2.

Workaround

None.

Description

Missing input validation of host names returned by Domain Name Servers
in the c-ares library before version 1.17.2 can lead to output of wrong
hostnames (leading to domain hijacking).

Impact

A remote attacker with the ability to create DNS entries could create
crafted entries that output the wrong hostname when resolved with
c-ares, leading to potential domain hijacking.

References

https://c-ares.haxx.se/adv_20210810.html
https://github.com/c-ares/c-ares/commit/362f91d807d293791008cdb7616d40f7784ece83
https://github.com/c-ares/c-ares/commit/44c009b8e62ea1929de68e3f438181bea469ec14
https://security.archlinux.org/CVE-2021-3672

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanyc-ares< 1.17.2-1UNKNOWN

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

5.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

0.002

Percentile

52.8%