Insufficient verification of data authenticity in c-ares - #VU156256

Vulnerability details

The vulnerability allows a remote attacker to poison DNS caches and manipulate DNS server selection.

The vulnerability exists due to insufficient verification of data authenticity in c-ares DNS reply handling when matching replies to outstanding queries without checking that they arrived on the connection used to send the query. A remote attacker can spoof replies matching a query ID and question on another open connection, or control a configured DNS server, to inject responses for queries sent to another server, bypass that server's DNS cookies, and use forged errors to steer queries away from a healthy server.

Exploitation affects applications with more than one DNS server configured.

Affected software

Remediation

External References

• https://github.com/c-ares/c-ares/security/advisories/GHSA-fqh5-3x7m-wp44
• https://github.com/c-ares/c-ares/commit/c8bd9ab53329f66ec0c395a11002a5696669b147

Related Security Bulletins

• Multiple vulnerabilities in c-ares