#VU27338 Buffer overflow in musl libc - CVE-2017-15650
Published: April 27, 2020
Vulnerability identifier: #VU27338
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2017-15650
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
musl libc
musl libc
Software vendor:
GNU
GNU
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary when processing DNS replies in dns_parse_callback(0 function in network/lookup_name.c. A remote attacker can send an unexpected number by sending A records in a reply to an AAAA query, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.