CVE-2020-6079: High severity Videolabs libmicrodns vulnerability
An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding of the domain name performed by rrdecode.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libmicrodnsto a version that resolves this vulnerability.Fixed in 0.2.0-1 - Upgrade
Upgrade
debian/vlcto a version that resolves this vulnerability.Fixed in 3.0.21-0+deb11u1Fixed in 3.0.21-0+deb12u1Fixed in 3.0.21-7 - Compensating control
Mitigate the denial-of-service by limiting or rate-restricting incoming mDNS (UDP multicast 224.0.0.251:5353) traffic from untrusted sources, and/or dropping repeated mDNS messages that target the affected service.
Event History
Frequently Asked Questions
What is the severity of CVE-2020-6079?
The severity of CVE-2020-6079 is high with a CVSS score of 7.5.
What is CVE-2020-6079?
CVE-2020-6079 is an exploitable denial-of-service vulnerability that exists in the resource allocation handling of Videolabs libmicrodns 0.1.0.
Which software is affected by CVE-2020-6079?
Videolabs libmicrodns 0.1.0, Debian Linux 9.0, Debian Linux 10.0, and VLC on Debian are affected by CVE-2020-6079.
How can CVE-2020-6079 be exploited?
CVE-2020-6079 can be exploited by triggering errors while parsing mDNS messages, which may lead to a denial-of-service condition via resource exhaustion.
How can CVE-2020-6079 be fixed?
To fix CVE-2020-6079, update to the latest version of the affected software or apply the appropriate security patches provided by the vendor.