medium6.5
CVE-2022-30295
uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning.
Impact
uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a value to 0x2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Uclibc | Uclibc | through 0.9.33.2 |
| Uclibc-Ng Project | Uclibc-Ng | through 1.0.40 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.kb.cert.org/vuls/id/473698
- https://www.nozominetworks.com/blog/nozomi-networks-discovers-unpatched-dns-bug-in-popular-c-standard-library-putting-iot-at-risk/
- https://www.kb.cert.org/vuls/id/473698
- https://www.nozominetworks.com/blog/nozomi-networks-discovers-unpatched-dns-bug-in-popular-c-standard-library-putting-iot-at-risk/