It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-198 advisory.

    A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the     input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of     service or a limited impact on confidentiality and integrity. (CVE-2022-4904)

    When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as     seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could     allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. (CVE-2023-31124)

    ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular     0::00:00:00/2 was found to cause an issue. C-ares only uses this function internally for configuration     purposes which would require an administrator to configure such an address via ares_set_sortlist().

    However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more     severe issues. (CVE-2023-31130)

    Insufficient randomness in generation of DNS query IDs

    When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used     for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable     output.Input from the random number generator is fed into a non-compilant RC4 implementation and may not     be as strong as the original RC4 implementation.No attempt is made to look for modern OS-provided CSPRNGs     like arc4random() that is widely available. (CVE-2023-31147)

    Denial of Service.

    Attack Steps:

    The target resolver sends a queryThe attacker forges a malformed UDP packet with a length of 0 and returns     them to the target resolverThe target resolver erroneously interprets the 0 length as a graceful shutdown     of the connection. (this is only valid for TCP connections, UDP is connection-less)Current resolution     fails, DoS attack is achieved. (CVE-2023-32067)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : c-ares, c-ares-devel (ALAS2023-2023-198)

high Nessus Plugin ID 176922

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Dec 12, 2024, 9:55 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202412120955
Version 1.1 Jun 8, 2023, 9:25 PM Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202306082125
Version 1.0 Jun 8, 2023, 10:31 AM New Plugin Feed: 202306081031