RUSTSEC-2018-0007

    Dashboard / Vulnerabilities / RUSTSEC-2018-0007

    RUSTSEC-2018-0007

    Published: 9 Oct 2018Last Modified: 8 Nov 2023

    Summary: Stack overflow when parsing malicious DNS packet

    Details: There's a stack overflow leading to a crash when Trust-DNS's parses a malicious DNS packet. Affected versions of this crate did not properly handle parsing of DNS message compression (RFC1035 section 4.1.4). The parser could be tricked into infinite loop when a compression offset pointed back to the same domain name to be parsed. This allows an attacker to craft a malicious DNS packet which when consumed with Trust-DNS could cause stack overflow and crash the affected software. The flaw was corrected by trust-dns-proto 0.4.3 and upcoming 0.5.0 release.

    References: https://crates.io/crates/trust-dns-proto, https://rustsec.org/advisories/RUSTSEC-2018-0007.html

    Affected packages

    Package

    Name: trust-dns-proto

    Purl: pkg:cargo/trust-dns-proto

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.0.0-0
    Fixed -0.4.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High