First Last Prev Next    This bug is not in your last search results.
Bug 1188881 - (CVE-2021-3672) VUL-0: CVE-2021-3672: c-ares,libcares2: Missing input validation on hostnames
(CVE-2021-3672)
VUL-0: CVE-2021-3672: c-ares,libcares2: Missing input validation on hostnames
Status: NEW
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/305288/
CVSSv3.1:SUSE:CVE-2021-3672:8.1:(AV:N...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2021-07-29 09:04 UTC by Robert Frohl
Modified: 2022-01-19 14:17 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 7 Robert Frohl 2021-08-10 06:50:19 UTC 
oss-security:

Missing input validation on hostnames returned by DNS servers
=============================================================

Project c-ares Security Advisory, August 10, 2021 -
[Permalink](https://c-ares.haxx.se/adv_20210810.html)

VULNERABILITY
-------------

Missing input validation of host names returned by Domain Name Servers in
the c-ares library can lead to output of wrong hostnames (leading to Domain
Hijacking).

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2021-3672 to this issue.


STEPS TO REPRODUCE
------------------

An example domain which has a cname including a zero byte:

```
$ adig cnamezero.test2.xdi-attack.net

Answers:
     cnamezero.test2.xdi-attack.net. 0 CNAME victim.test2.xdi-attack.net\000.test2.xdi-attack.net.
     victim.test2.xdi-attack.net\000.test2.xdi-attack.net. 0 A 141.12.174.88
```

When resolved via a vulnerable implementation, the CNAME alias and name of the
A record will seem to be `victim.test2.xdi-attack.net` instead of
`victim.test2.xdi-attack.net\000.test2.xdi-attack.net`, a totally different
domain.

This is a clear error in zero-byte handling and can potentially lead to
DNS-cache injections in case an application implements a cache based on the
library.


AFFECTED VERSIONS
-----------------

This flaw exists in the following c-ares versions.

- Affected versions: c-ares 1.0.0 to and including 1.17.1
- Not affected versions: c-ares >= 1.17.2


THE SOLUTION
------------

In version 1.17.2, the function has been corrected and a test case have been
added to verify.

A [patch for
CVE-2021-3672](https://github.com/c-ares/c-ares/compare/809d5e8..44c009b.patch)
is available.


RECOMMENDATIONS
---------------

We suggest you take one of the following actions immediately, in order of
preference:

  A - Upgrade c-ares to version 1.17.2

  B - Apply the patch to your version and rebuild


TIME LINE
---------

It was reported to the c-ares project on June 11, 2021 by Philipp Jeitner and
Haya Shulman, Fraunhofer SIT.

c-ares 1.17.2 was released on August 10 2021, coordinated with the publication
of this advisory.


CREDITS
-------

Thanks to Philipp Jeitner and Haya Shulman, Fraunhofer SIT for the report.
Comment 8 Swamp Workflow Management 2021-08-10 13:41:04 UTC 
SUSE-SU-2021:14776-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1188881
CVE References: CVE-2021-3672
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    libcares2-1.7.4-7.10.3.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    libcares2-1.7.4-7.10.3.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    libcares2-1.7.4-7.10.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 OBSbugzilla Bot 2021-08-12 15:20:11 UTC 
This is an autogenerated message for OBS integration:
This bug (1188881) was mentioned in
https://build.opensuse.org/request/show/911845 Factory / c-ares
Comment 10 OBSbugzilla Bot 2021-08-12 20:30:06 UTC 
This is an autogenerated message for OBS integration:
This bug (1188881) was mentioned in
https://build.opensuse.org/request/show/911861 Factory / nodejs16
https://build.opensuse.org/request/show/911862 Factory / nodejs14
Comment 13 Swamp Workflow Management 2021-08-16 19:16:57 UTC 
SUSE-SU-2021:2690-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1188881
CVE References: CVE-2021-3672
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    libcares2-1.9.1-9.7.1
SUSE OpenStack Cloud Crowbar 8 (src):    libcares2-1.9.1-9.7.1
SUSE OpenStack Cloud 9 (src):    libcares2-1.9.1-9.7.1
SUSE OpenStack Cloud 8 (src):    libcares2-1.9.1-9.7.1
SUSE Linux Enterprise Workstation Extension 12-SP5 (src):    libcares2-1.9.1-9.7.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    libcares2-1.9.1-9.7.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    libcares2-1.9.1-9.7.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    libcares2-1.9.1-9.7.1
SUSE Linux Enterprise Server 12-SP5 (src):    libcares2-1.9.1-9.7.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    libcares2-1.9.1-9.7.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    libcares2-1.9.1-9.7.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    libcares2-1.9.1-9.7.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    libcares2-1.9.1-9.7.1
HPE Helion Openstack 8 (src):    libcares2-1.9.1-9.7.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2021-08-17 19:25:57 UTC 
openSUSE-SU-2021:2760-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1188881
CVE References: CVE-2021-3672
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    c-ares-1.17.1+20200724-3.14.1
Comment 15 Swamp Workflow Management 2021-08-17 19:35:13 UTC 
SUSE-SU-2021:2760-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1188881
CVE References: CVE-2021-3672
JIRA References: 
Sources used:
SUSE Manager Server 4.0 (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Manager Retail Branch Server 4.0 (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Manager Proxy 4.0 (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Linux Enterprise Server for SAP 15 (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Linux Enterprise Server 15-LTSS (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    c-ares-1.17.1+20200724-3.14.1
SUSE Enterprise Storage 6 (src):    c-ares-1.17.1+20200724-3.14.1
SUSE CaaS Platform 4.0 (src):    c-ares-1.17.1+20200724-3.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 OBSbugzilla Bot 2021-08-19 16:00:07 UTC 
This is an autogenerated message for OBS integration:
This bug (1188881) was mentioned in
https://build.opensuse.org/request/show/913180 Factory / nodejs16
Comment 17 Swamp Workflow Management 2021-08-19 19:24:20 UTC 
openSUSE-SU-2021:1168-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1188881
CVE References: CVE-2021-3672
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    c-ares-1.17.1+20200724-lp152.2.9.1, c-ares-tests-1.17.1+20200724-lp152.2.9.1
Comment 18 Swamp Workflow Management 2021-08-24 16:16:59 UTC 
# maintenance_jira_update_notice
SUSE-SU-2021:2823-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1188881,1188917,1189369,1189370
CVE References: CVE-2021-22930,CVE-2021-22931,CVE-2021-22939,CVE-2021-3672
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Web Scripting 12 (src):    nodejs10-10.24.1-1.42.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 19 Swamp Workflow Management 2021-08-24 16:18:30 UTC 
# maintenance_jira_update_notice
SUSE-SU-2021:2824-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1188881,1188917,1189368,1189369,1189370
CVE References: CVE-2021-22930,CVE-2021-22931,CVE-2021-22939,CVE-2021-22940,CVE-2021-3672
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Web Scripting 12 (src):    nodejs12-12.22.5-1.35.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 20 Swamp Workflow Management 2021-08-30 19:22:12 UTC 
# maintenance_jira_update_notice
SUSE-SU-2021:2875-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1188881,1188917,1189368,1189369,1189370
CVE References: CVE-2021-22930,CVE-2021-22931,CVE-2021-22939,CVE-2021-22940,CVE-2021-3672
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Web Scripting 15-SP3 (src):    nodejs12-12.22.5-4.19.1
SUSE Linux Enterprise Module for Web Scripting 15-SP2 (src):    nodejs12-12.22.5-4.19.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 21 Swamp Workflow Management 2021-08-30 19:36:26 UTC 
# maintenance_jira_update_notice
openSUSE-SU-2021:2875-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1188881,1188917,1189368,1189369,1189370
CVE References: CVE-2021-22930,CVE-2021-22931,CVE-2021-22939,CVE-2021-22940,CVE-2021-3672
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    nodejs12-12.22.5-4.19.1
Comment 22 Swamp Workflow Management 2021-08-31 10:20:12 UTC 
# maintenance_jira_update_notice
openSUSE-SU-2021:1214-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1188881,1188917,1189368,1189369,1189370
CVE References: CVE-2021-22930,CVE-2021-22931,CVE-2021-22939,CVE-2021-22940,CVE-2021-3672
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    nodejs12-12.22.5-lp152.3.18.1
Comment 23 Swamp Workflow Management 2021-09-03 16:18:15 UTC 
# maintenance_jira_update_notice
SUSE-SU-2021:2953-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1188881,1188917,1189369,1189370
CVE References: CVE-2021-22930,CVE-2021-22931,CVE-2021-22939,CVE-2021-3672
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Web Scripting 15-SP2 (src):    nodejs10-10.24.1-1.39.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 24 Swamp Workflow Management 2021-09-03 16:20:42 UTC 
# maintenance_jira_update_notice
openSUSE-SU-2021:2953-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1188881,1188917,1189369,1189370
CVE References: CVE-2021-22930,CVE-2021-22931,CVE-2021-22939,CVE-2021-3672
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    nodejs10-10.24.1-1.39.2
Comment 25 Swamp Workflow Management 2021-09-07 13:30:58 UTC 
# maintenance_jira_update_notice
openSUSE-SU-2021:1239-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1188881,1188917,1189369,1189370
CVE References: CVE-2021-22930,CVE-2021-22931,CVE-2021-22939,CVE-2021-3672
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    nodejs10-10.24.1-lp152.2.18.1
Comment 26 Swamp Workflow Management 2021-09-22 16:21:31 UTC 
SUSE-SU-2021:3184-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1188881,1188917,1189368,1189369,1189370
CVE References: CVE-2021-22930,CVE-2021-22931,CVE-2021-22939,CVE-2021-22940,CVE-2021-3672
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Web Scripting 12 (src):    nodejs14-14.17.5-6.15.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 27 Swamp Workflow Management 2021-09-23 19:17:07 UTC 
SUSE-SU-2021:3211-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1188881,1188917,1189368,1189369,1189370
CVE References: CVE-2021-22930,CVE-2021-22931,CVE-2021-22939,CVE-2021-22940,CVE-2021-3672
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Web Scripting 15-SP3 (src):    nodejs14-14.17.5-5.15.5
SUSE Linux Enterprise Module for Web Scripting 15-SP2 (src):    nodejs14-14.17.5-5.15.5

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 28 Swamp Workflow Management 2021-09-23 19:30:44 UTC 
openSUSE-SU-2021:3211-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1188881,1188917,1189368,1189369,1189370
CVE References: CVE-2021-22930,CVE-2021-22931,CVE-2021-22939,CVE-2021-22940,CVE-2021-3672
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    nodejs14-14.17.5-5.15.5
Comment 29 Swamp Workflow Management 2021-09-28 10:18:07 UTC 
openSUSE-SU-2021:1313-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1188881,1188917,1189368,1189369,1189370
CVE References: CVE-2021-22930,CVE-2021-22931,CVE-2021-22939,CVE-2021-22940,CVE-2021-3672
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    nodejs14-14.17.5-lp152.14.1
First Last Prev Next    This bug is not in your last search results.