PT-2018-15487 · Trust Dns · Trust-Dns-Proto

Published 2018-10-09 · Updated 2021-08-25 · CVE-2018-20994

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions trust-dns-proto versions prior to 0.4.3 trust-dns-proto versions prior to 0.5.0

Description The issue arises from the mishandling of DNS message compression, leading to infinite recursion and a stack overflow when parsing a malicious DNS packet. This allows an attacker to craft a malicious packet that, when consumed by the affected software, could cause a crash. The parser can be tricked into an infinite loop when a compression offset points back to the same domain name to be parsed.

Recommendations For trust-dns-proto versions prior to 0.4.3, update to version 0.4.3 or later to resolve the issue. For trust-dns-proto versions prior to 0.5.0, update to version 0.5.0 or later once it is released. As a temporary workaround, consider restricting the use of the DNS message compression feature until a patch is available.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2018-20994

GHSA-369H-PJR2-6WRH

RUSTSEC-2018-0007

Affected Products

Trust-Dns-Proto

References · 7

• https://osv.dev/vulnerability/CVE-2018-20994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20994 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2018-0007 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-369h-pjr2-6wrh · Vendor Advisory
• https://github.com/bluejekyll/trust-dns · Note
• https://crates.io/crates/trust-dns-proto · Note
• https://rustsec.org/advisories/RUSTSEC-2018-0007.html · Note