0-byte UDP payload DoS in c-ares
CVE-2023-32067

7.5HIGH

Key Information:

Vendor

C-ares

Status
C-ares
Vendor
CVE Published:
25 May 2023

What is CVE-2023-32067?

The c-ares asynchronous resolver library is susceptible to a denial of service attack. An attacker can exploit this vulnerability by sending a specially crafted malformed UDP packet with a length of 0. When the target resolver receives this packet, it incorrectly interprets the zero length as a signal for a graceful connection shutdown. This misinterpretation can lead to service interruptions. The issue has been addressed in version 1.19.1 of c-ares, emphasizing the importance of updating to the latest version to mitigate this risk.

Affected Version(s)

c-ares < 1.19.1

References

https://github.com/c-ares/c-ares/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1
x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-ann...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.