SB2023110774 - Red Hat Enterprise Linux 9 update for c-ares
Published: November 7, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2022-4904)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the config_sortlist() function. A local user can trigger memory corruption and perform a denial of service (DoS) attack.
2) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CVE-ID: CVE-2023-31124)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an error when cross-compiling c-ares and using the autotools build system. As a result, the CARES_RANDOM_FILE is not be set, which results in usage of a rand() function as a fallback, leading to weak entropy.
3) Buffer Underwrite ('Buffer Underflow') (CVE-ID: CVE-2023-31130)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a buffer underflow when using certain IPv6 addresses, such as 0::00:00:00/2". A local privileged user can trigger a boundary error and crash the service.
4) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CVE-ID: CVE-2023-31147)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to usage of a rand() function in case /dev/urandom or RtlGenRandom() are unavailable. A remote attacker can perform spoofing attack.
Remediation
Install update from vendor's website.