PT-2024-21058 · Dnsjava+2 · Dnsjava+2
Bellebaum
·
Published
2024-07-22
·
Updated
2026-05-18
·
CVE-2024-25638
CVSS v3.1
8.9
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
dnsjava versions prior to 3.6.0
Description
The issue arises from dnsjava not checking the relevance of records in DNS replies to the query, allowing an attacker to respond with records from different zones. This can lead to applications blindly filtering received results and potentially taking irrelevant records as authentic answers. The vulnerability can be exploited in various scenarios, including exchanging SRV records to redirect user credentials, exchanging MX records for information disclosure, and manipulating the root of trust for dependent applications by exchanging URI and SMIMEA records.
Recommendations
For versions prior to 3.6.0, update to version 3.6.0 to fix the vulnerability.
As a temporary workaround, consider filtering the received RRs using an algorithm that verifies the authenticity and relevance of the records to the query.
When using a ValidatingResolver, ignore any Server indications of whether or not data was available.
For APIs returning RRs from DNS responses, filter the RRs to ensure they are relevant to the query.
Exploit
Fix
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Red Os
Dnsjava