Denial of Service Vulnerability in libidn: Out-of-Bounds Read Risk
Summary
ALPINE-CVE-2016-6261: The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input. Affects libidn versions < 1.33-r0. Fixed in 1.33-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libidn is a library that provides support for Internationalized Domain Names (IDN) in applications. It allows software to handle domain names in various languages and scripts, ensuring compatibility across different systems. The library is widely used in various applications that require domain name resolution. However, a vulnerability has been identified in libidn that could potentially lead to a denial of service, affecting the stability of applications that rely on it.
Vulnerability Detail
The vulnerability, identified as CVE-2016-6261, originates from the idna_to_ascii_4i function in lib/idna.c within libidn versions prior to 1.33. It allows context-dependent attackers to exploit the library by providing 64 bytes of input, which can cause an out-of-bounds read and crash the application. This vulnerability poses a significant risk as it can lead to service interruptions, making applications unresponsive and affecting user experience.
How To Fix
Minimum fixed version
1.33-r0
This is the first release that contains the fix.
sudo apk add --upgrade libidnTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to restrict the size and format of input being processed by the libidn library. This can help mitigate the risk of triggering the vulnerability until a proper update can be applied.
Conclusion
The CVE-2016-6261 vulnerability in libidn poses a significant risk of denial of service due to an out-of-bounds read. It is crucial for users of this library to update to the patched version to ensure the stability and security of their applications. Implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for libidn →
FAQ
CVE-2016-6261 is a vulnerability in libidn that allows attackers to cause a denial of service through an out-of-bounds read.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to application crashes, resulting in service downtime and a poor user experience.
Yes, the patched version of libidn is 1.33-r0 or later. Updating to this version will resolve the vulnerability.
The CVSS score for CVE-2016-6261 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for libidn.
