VU#473698: CVE-2022-30295 - uClibc, uClibc-ng Libraries Have Monotonically Increasing DNS Transaction ID | allinfosecnews.com

May 9, 2022, 6:58 p.m. |

CERT Recently Published Vulnerability Notes kb.cert.org

Overview

The uClibc and uClibc-ng libraries are vulnerable to DNS cache poisoning due to the use of predicatble DNS transaction IDs when making DNS requests. This vulnerability can allow an attacker to perform DNS cache poisoning attacks against a vulnerable environment.

Description

The uClibc and the Uclibc-ng software are lightweight C standard libraries intended for use in embedded systems and mobile devices. The uClibc library has not been updated since May of 2012. The newer uClibc-ng is the currently maintained …

cve dns id transaction id uclibc

More from kb.cert.org / CERT Recently Published Vulnerability Notes

VU#253266: Keras 2 Lambda Layers Allow Arbitrary Code Injection in TensorFlow Models 6 days, 19 hours ago | kb.cert.org

application arbitrary code attacker attackers +14

VU#123335: Multiple Programming Languages Fail to Escape Arguments Properly in Microsoft Windows 1 week, 6 days ago | kb.cert.org

arbitrary code attackers cases code +15

VU#155143: Linux kernel on Intel systems is susceptible to Spectre v2 attacks 2 weeks ago | kb.cert.org

architectures attacker attacks bhi +20

VU#421644: HTTP/2 CONTINUATION frames can be utilized for DoS attacks 2 weeks, 5 days ago | kb.cert.org

attacks can dos fragments +6

VU#417980: UDP-based, application-layer protocol implementations are vulnerable to network loops 1 month ago | kb.cert.org

abuse application applications attacker +18

VU#488902: CPU hardware utilizing speculative execution may be vulnerable to speculative race conditions 1 month, 1 week ago | kb.cert.org

architectures attacker can conditions +13

VU#949046: Sceiner firmware locks and associated devices are vulnerable to encryption downgrade and arbitrary file … 1 month, 2 weeks ago | kb.cert.org

app attacks bluetooth called +11

VU#446598: GPU kernel implementations susceptible to memory leak 3 months ago | kb.cert.org

access amd apple attacker +18

VU#302671: SMTP end-of-data uncertainty can be abused to spoof emails and bypass policies 3 months, 1 week ago | kb.cert.org

attacker bypass can data +17

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

View on infosec-jobs.com

Network AWS Cloud &Firewall Engineer

@ Arthur Grand Technologies Inc | Plano, TX, United States

View on infosec-jobs.com

Lead Consultant, Data Centre & BCP

@ Singtel | Singapore, Singapore

View on infosec-jobs.com

Protocol Security Engineer

@ Osmosis Labs | Remote

View on infosec-jobs.com

Technical Engineer - Payments Security Specialist

@ H&M Group | Bengaluru, India

View on infosec-jobs.com

Intern, Security Architecture

@ Sony | Work from Home-CA

View on infosec-jobs.com