PT-2020-2146 · Videolabs+1 · Libmicrodns+1
Claudio Bozzato
·
Published
2020-03-24
·
Updated
2025-01-28
·
CVE-2020-6077
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Videolabs libmicrodns version 0.1.0
Description
The issue is related to a denial-of-service vulnerability in the message-parsing functionality of libmicrodns. It occurs when parsing mDNS messages, as the implementation does not properly track the available data in the message, possibly leading to an out-of-bounds read. This could result in a denial of service. An attacker can trigger this vulnerability by sending a specially crafted mDNS message.
Recommendations
For version 0.1.0, consider disabling the message-parsing functionality of libmicrodns until a patch is available to prevent potential exploitation. Restrict access to the vulnerable module to minimize the risk of triggering the denial-of-service condition. Avoid using the vulnerable version of libmicrodns in applications that rely on mDNS message parsing until the issue is resolved.
Exploit
Fix
DoS
Out of bounds Read
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ubuntu
Libmicrodns