CVE-2013-7423: Medium severity redhat Enterprise Linux Server Aus vulnerability
It was reported [1] that under high load, getaddrinfo() starts sending DNS queries to random file descriptors, e.g. some unrelated socket connected to a remote service.
[1]: https://sourceware.org/bugzilla/showbug.cgi?id=15946
Other sources
The senddg function in resolv/ressend.c in GNU C Library (aka glibc or libc6) before 2.20 does not properly reuse file descriptors, which allows remote attackers to send DNS queries to unintended locations via a large number of requests that trigger a call to the getaddrinfo function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7423?
CVE-2013-7423 has a medium severity rating due to its potential to allow remote attackers to send DNS queries to unintended locations.
How do I fix CVE-2013-7423?
To mitigate CVE-2013-7423, update the GNU C Library to version 2.20 or later as recommended by your operating system vendor.
Which software versions are affected by CVE-2013-7423?
CVE-2013-7423 affects various versions of the GNU C Library and several Linux distributions including Red Hat Enterprise Linux 6.5 and multiple versions of Ubuntu and openSUSE.
What type of attack does CVE-2013-7423 enable?
CVE-2013-7423 enables remote attackers to exploit file descriptor reuse issues in DNS queries, leading to potential information leakage.
Is CVE-2013-7423 still a threat today?
While CVE-2013-7423 has been addressed in later versions of software, systems running affected versions remain vulnerable if not updated.