PT-2024-13939 · Emdns · Emdns

Published 2024-04-29 · Updated 2024-08-01 · CVE-2023-50434

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions emdns versions through fbd1eef

Description The issue arises from the emdns resolve raw function in emdns.c, which calls strlen with an input that may not be 0 terminated, leading to a stack-based buffer over-read. This can be triggered by a remote adversary that can send DNS requests to the emdns server. The impact could vary depending on the system libraries, compiler, and processor architecture.

Recommendations For emdns versions through fbd1eef, as a temporary workaround, consider restricting access to the emdns server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2023-50434

Affected Products

Emdns

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-50434 · Security Note
• https://papers.mathyvanhoef.com/esorics2024.pdf · Note
• https://t.me/cvenotify/78487 · Telegram Post