Inefficient Algorithmic Complexity in c-ares - #VU137034

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in ares_dns_name_parse() when parsing crafted DNS responses with unbounded compression pointer chains. A remote attacker can send a specially crafted DNS response to cause a denial of service.

Because c-ares runs on a single-threaded event loop, parsing a crafted response can stall all resolution for the duration.

Affected software

Remediation

External References

• https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76
• https://github.com/c-ares/c-ares/commit/5c8341ba6ff3a8e4e4dfd616f8ed0418838b8b7b

Related Security Bulletins

• Multiple vulnerabilities in c-ares