A flaw was found in c-ares library where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

🗓️ 27 Nov 2021 08:00:00Reported by MicrosoftType

Flaw in c-ares library fails to validate DNS hostnames, risking incorrect hostnames and hijacking.

Reporter	Title	Published	Views	Family All 314
ALT Linux	Security fix for the ALT Linux 9 package c-ares version 1.17.2-alt1	19 Aug 202100:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package node version 14.17.5-alt1	17 Aug 202100:00	–	altlinux
FreeBSD	py39-pycares -- domain hijacking vulnerability	11 Jun 202100:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	20 Apr 202214:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	31 May 202214:57	–	ibm
ATTACKERKB	CVE-2021-3672	23 Nov 202119:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : c-ares (ALAS-2024-2399)	9 Jan 202400:00	–	nessus
Tenable Nessus	Amazon Linux AMI : c-ares (ALAS-2021-1545)	5 Nov 202100:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0072: nodejs:14 (ALINUX3-SA-2021:0072)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : c-ares (ALSA-2022:2043)	12 May 202200:00	–	nessus