uClibc, uClibc-ng libraries have monotonically increasing DNS transaction ID

ronjor · Feb 22, 2023

Vulnerability Note VU#473698
Original Release Date: 2022-05-09 | Last Revised: 2023-02-22

Overview
The uClibc and uClibc-ng libraries, prior to uClibc-ng 1.0.41, are vulnerable to DNS cache poisoning due to the use of predicatble DNS transaction IDs when making DNS requests. This vulnerability can allow an attacker to perform DNS cache poisoning attacks against a vulnerable environment.
Click to expand...

Solution
Apply a patch
If your vendor has developed a patched version of uClibc or uClibc-ng to address this issue, apply the updates provided by your vendor. uClibc-ng was updated to 1.0.41 on 05/20/2022.
Click to expand...

Log in or Sign up

uClibc, uClibc-ng libraries have monotonically increasing DNS transaction ID

ronjor Global Moderator

Log in or Sign up

uClibc, uClibc-ng libraries have monotonically increasing DNS transaction ID

ronjor Global Moderator

Useful Searches