Resource exhaustion in libmicrodns - CVE-2020-6080
Published: March 24, 2020
Vulnerability identifier: #VU26341
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-6080
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to encountering errors while parsing mDNS messages in the "rr_read_TXT" function in the resource allocation handling. A remote attacker can send mDNS messages, trigger resource exhaustion and perform a denial of service (DoS) attack.
Affected software
libmicrodns
Arch Linux
Gentoo Linux
Ubuntu
vlc (Debian package)
libmicrodns0 (Ubuntu package)
Arch Linux
Gentoo Linux
Ubuntu
vlc (Debian package)
libmicrodns0 (Ubuntu package)
How to mitigate CVE-2020-6080
Install updates from vendor's website.
libmicrodns - update to 0.1.1
vlc (Debian package) - update to 3.0.10-0+deb9u1
libmicrodns0 (Ubuntu package) - update to Ubuntu Pro
vlc (Debian package) - update to 3.0.10-0+deb9u1
libmicrodns0 (Ubuntu package) - update to Ubuntu Pro