Описание
NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.
A flaw was found in ldns. When applications use ldns as a resolver over User Datagram Protocol (UDP), it fails to properly match the query's destination address and port with the response's source address and port. Additionally, the query ID and question are not matched with the response. This vulnerability allows a remote attacker to perform off-path poisoning attacks, potentially leading to DNS cache poisoning and redirection to malicious resources.
Отчет
This Important flaw in ldns, when utilized as a UDP stub resolver, allows remote attackers to conduct off-path DNS poisoning attacks. The vulnerability stems from insufficient validation of DNS query and response parameters, including destination/source addresses, ports, query IDs, and questions. This can lead to DNS cache poisoning, potentially redirecting users to malicious resources.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| ExternalDNS Operator | edo/external-dns-rhel8 | Affected | ||
| ExternalDNS Operator | edo/external-dns-rhel9 | Affected | ||
| Red Hat Enterprise Linux 6 | ldns | Affected | ||
| Red Hat Enterprise Linux 7 | ldns | Affected | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Not affected | ||
| Red Hat OpenShift Dev Spaces | devspaces/traefik-rhel9 | Affected | ||
| Red Hat Enterprise Linux 10 | ldns | Fixed | RHSA-2026:49836 | 04.08.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | ldns | Fixed | RHSA-2026:53402 | 11.08.2026 |
| Red Hat Enterprise Linux 8 | ldns | Fixed | RHSA-2026:49520 | 03.08.2026 |
| Red Hat Enterprise Linux 9 | ldns | Fixed | RHSA-2026:50108 | 04.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.
NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulnerable for off-path poisoning attacks. The drill tool, which is shipped with ldns, suffers from this vulnerability.
NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in ...
EPSS
7.5 High
CVSS3