Unpatched DNS Bug in Popular C Standard Library Putting IoT at Risk

Cyber Castrum LLP Cyber Castrum LLP

Cyber Castrum LLP

Strong|Safe|Secure

发布日期: 2022年5月9日
+ 关注

A vulnerability (tracked under CVE-2022-30295, ICS-VU-638779, VU#473698) affecting the Domain Name System (DNS) implementation of all versions of uClibc and uClibc-ng, a popular C standard library in IoT products.

- The flaw is caused by the predictability of transaction IDs included in the DNS requests generated by the library, which may allow attackers to perform DNS poisoning attacks against the target device.

- DNS can be a valuable target for attackers. In a DNS poisoning attack, an attacker can deceive a DNS client into accepting a forged response, thus inducing a certain program into performing network communications with an arbitrarily defined endpoint, and not the legitimate one.?

For Further Reference :


要查看或添加评论，请登录

Cyber Castrum LLP的更多文章

社区洞察

其他会员也浏览了