#VU66538 Input validation error in dproxy - CVE-2022-33990

Vulnerability identifier: #VU66538

Vulnerability risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-33990

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
dproxy
Server applications / DNS servers

Vendor: dproxy

Description

The vulnerability allows a remote attacker to perform DNS cache poisoning attacks.

The vulnerability exists due to insufficient validation of special domain name characters. A remote attacker can send specially crafted input to the application and perform DNS cache poisoning attacks.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

dproxy: 0.5

---

External links
https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner
https://www.usenix.org/conference/usenixsecurity21/presentation/jeitner
https://www.openwall.com/lists/oss-security/2022/08/14/3

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.