ArchLinux: 202004-24: libmicrodns: multiple issues
Summary
- CVE-2020-6071 (denial of service)
An exploitable denial-of-service vulnerability exists in the resource
record-parsing functionality of Videolabs libmicrodns 0.1.0. When
parsing compressed labels in mDNS messages, the compression pointer is
followed without checking for recursion, leading to a denial of
service. An attacker can send an mDNS message to trigger this
vulnerability.
- CVE-2020-6072 (arbitrary code execution)
An exploitable code execution vulnerability exists in the label-parsing
functionality of Videolabs libmicrodns 0.1.0. When parsing compressed
labels in mDNS messages, the rr_decode function's return value is not
checked, leading to a double free that could be exploited to execute
arbitrary code. An attacker can send an mDNS message to trigger this
vulnerability.
- CVE-2020-6073 (information disclosure)
An exploitable denial-of-service vulnerability exists in the TXT
record-parsing functionality of Videolabs libmicrodns 0.1.0. When
parsing the RDATA section in a TXT record in mDNS messages, multiple
integer overflows can be triggered, leading to a denial of service. An
attacker can send an mDNS message to trigger this vulnerability.
- CVE-2020-6077 (information disclosure)
An exploitable denial-of-service vulnerability exists in the message-
parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS
messages, the implementation does not properly keep track of the
available data in the message, possibly leading to an out-of-bounds
read that would result in a denial of service. An attacker can send an
mDNS message to trigger this vulnerability.
- CVE-2020-6078 (denial of service)
An exploitable denial-of-service vulnerability exists in the message-
parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS
messages in mdns_recv, the return value of the mdns_read_header
function is not checked, leading to an uninitialized variable usage
that eventually results in a null pointer dereference, leading to
service crash. An attacker can send a series of mDNS messages to
trigger this vulnerability.
- CVE-2020-6079 (denial of service)
Multiple exploitable denial-of-service vulnerabilities exist in the
resource allocation handling of Videolabs libmicrodns 0.1.0. When
encountering errors while parsing mDNS messages, some allocated data is
not freed, possibly leading to a denial-of-service condition via
resource exhaustion. An attacker can send one mDNS message repeatedly
to trigger these vulnerabilities.
- CVE-2020-6080 (denial of service)
Multiple exploitable denial-of-service vulnerabilities exist in the
resource allocation handling of Videolabs libmicrodns 0.1.0. When
encountering errors while parsing mDNS messages, some allocated data is
not freed, possibly leading to a denial-of-service condition via
resource exhaustion. An attacker can send one mDNS message repeatedly
to trigger these vulnerabilities.
Resolution
Upgrade to 0.1.2-1.
# pacman -Syu "libmicrodns>=0.1.2-1"
The problems have been fixed upstream in version 0.1.2.
References
https://github.com/videolabs/libmicrodns/releases/tag/0.1.1 https://talosintelligence.com/vulnerability_reports/TALOS-2020-0994 https://github.com/videolabs/libmicrodns/commit/0103f40371cd6e5f034d1ea5674cd33316fef518 https://talosintelligence.com/vulnerability_reports/TALOS-2020-0995 https://github.com/videolabs/libmicrodns/commit/219b180c3cea9ad674a5512412fbd75592f61aa7 https://talosintelligence.com/vulnerability_reports/TALOS-2020-0996 https://github.com/videolabs/libmicrodns/commit/f0e8a723ef2d0a7ef9e200a8fd7c561d4695c5cf https://talosintelligence.com/vulnerability_reports/TALOS-2020-1000 https://github.com/videolabs/libmicrodns/commit/80860fad7e046959b730a0e37fd8d6ad955682ec https://talosintelligence.com/vulnerability_reports/TALOS-2020-1001 https://github.com/videolabs/libmicrodns/commit/4fb18284bea9a4f5eaf7745d72965b9b24e27d61 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1002 https://github.com/videolabs/libmicrodns/commit/9768bdbeb8ea6b7849a97af4362d1b5184352cee https://security.archlinux.org/CVE-2020-6071 https://security.archlinux.org/CVE-2020-6072 https://security.archlinux.org/CVE-2020-6073 https://security.archlinux.org/CVE-2020-6077 https://security.archlinux.org/CVE-2020-6078 https://security.archlinux.org/CVE-2020-6079 https://security.archlinux.org/CVE-2020-6080
Workaround
None.
