An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is followed without checking for recursion, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7239-1 advisory.

    It was discovered that libmicrodns could recursively follow the same compression pointer, leading to an     infinite loop. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-6071)

    It was discovered that libmicrodns did not check the return value of the rr_decode function, which could     lead to a double free. An attacker could possibly use this issue to execute arbitrary code.
    (CVE-2020-6072)

    It was discovered that libmicrodns incorrectly handled certain inputs, which could lead to an integer     overflow. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-6073)

    It was discovered that libmicrodns incorrectly handled certain inputs, which could lead to a out-of-bounds     read. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-6077)

    It was discovered that libmicrodns incorrectly handled memory when parsing mDNS messages in mdns_recv,     which could lead to a NULL pointer dereference. An attacker could possibly use this issue to cause a     denial of service. (CVE-2020-6078)

    It was discovered that libmicrodns incorrectly handled memory, which could lead to excessive memory     consumption due to memory leaks. An attacker could possibly use this issue to cause a denial of service.
    (CVE-2020-6079, CVE-2020-6080)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs
    libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the rr_decode function's return value
    is not checked, leading to a double free that could be exploited to execute arbitrary code. An attacker
    can send an mDNS message to trigger this vulnerability. (CVE-2020-6072)

  - An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before
    3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file.
    NOTE: this may be related to the SDL_Image product. (CVE-2019-19721)

  - An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of
    Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is
    followed without checking for recursion, leading to a denial of service. An attacker can send an mDNS
    message to trigger this vulnerability. (CVE-2020-6071)

  - An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs
    libmicrodns 0.1.0. When parsing the RDATA section in a TXT record in mDNS messages, multiple integer
    overflows can be triggered, leading to a denial of service. An attacker can send an mDNS message to
    trigger this vulnerability. (CVE-2020-6073)

The remote host is affected by the vulnerability described in GLSA-202005-10 (libmicrodns: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libmicrodns. Please       review the CVE identifiers and the upstream advisory referenced below for       details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The version of VLC media player installed on the remote Windows host is prior to 3.0.9. It is, therefore, affected by multiple vulnerabilities:

  - An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs     libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is followed without checking     for recursion, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability     (CVE-2020-6071).     

  - An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0.     When parsing compressed labels in mDNS messages, the rr_decode function's return value is not checked, leading to a     double free that could be exploited to execute arbitrary code. An attacker can send an mDNS message to trigger this     vulnerability (CVE-2020-6072).

  - An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs libmicrodns 0.1.0.     When parsing the RDATA section in a TXT record in mDNS messages, multiple integer overflows can be triggered, leading to a denial     of service. An attacker can send an mDNS message to trigger this vulnerability (CVE-2020-6073).

  - An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0.     When parsing mDNS messages, the implementation does not properly keep track of the available data in the message, possibly leading     to an out-of-bounds read that would result in a denial of service. An attacker can send an mDNS message to trigger this     vulnerability (CVE-2020-6077).

  - An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0.     When parsing mDNS messages in mdns_recv, the return value of the mdns_read_header function is not checked, leading to an uninitialized     variable usage that eventually results in a null pointer dereference, leading to service crash. An attacker can send a series of     mDNS messages to trigger this vulnerability (CVE-2020-6078).

  - An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0.     When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service     condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding     of the domain name performed by rr_decode (CVE-2020-6079).

Multiple security issues were discovered in the microdns plugin of the VLC media player, which could result in denial of service or potentially the execution of arbitrary code via malicious mDNS packets.

ID	Name	Product	Family	Severity
214737	Ubuntu 18.04 LTS : libmicrodns vulnerabilities (USN-7239-1)	Nessus	Ubuntu Local Security Checks	critical
407539	Alpine: multiple vlc packages: security update to 3.0.9.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
407539	Alpine: multiple vlc packages: security update to 3.0.9.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
136640	GLSA-202005-10 : libmicrodns: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
136422	VLC < 3.0.9 Multiple Vulnerabilities	Nessus	Windows	critical
136291	Debian DSA-4671-1 : vlc - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2020-6071

high

Tenable Plugins

critical

critical

critical

critical

critical

critical