CVE-2021-43523
Critical
Description
In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers via gethostbyname, getaddrinfo, gethostbyaddr, and getnameinfo can lead to output of wrong hostnames (leading to domain hijacking) or injection into applications (leading to remote code execution, XSS, applications crashes, etc.). In other words, a validation step, which is expected in any stub resolver, does not occur.
SeverityCritical
CVSS9.6
Exploit probability—
ProductUclibc
PublishedNov 10, 2021
First seenNov 10, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- uclibc-ng_project uclibc-ng1.0.39 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| uclibc uclibc | v ≤ 0.9.33.2 | — |
| uclibc-ng_project uclibc-ng | v < 1.0.39 | 1.0.39 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.