Videolabs libmicrodns up to 0.1.0 resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Videolabs libmicrodns up to 0.1.0. This affects an unknown function. The manipulation leads to resource consumption. This vulnerability is uniquely identified as CVE-2020-6079. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Videolabs libmicrodns up to 0.1.0. This issue affects an unknown functionality. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding of the domain name performed by rr_decode.

The weakness was disclosed 03/24/2020. The identification of this vulnerability is CVE-2020-6079 since 01/07/2020. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 214737 (Ubuntu 18.04 LTS : libmicrodns vulnerabilities (USN-7239-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.1.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (214737). The entries VDB-152238, VDB-152236, VDB-152235 and VDB-152234 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Videolabs

Name

• libmicrodns

Version

• 0.1.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion