Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
c-ares before 1.4.0 uses a predictable seed for the random number generator for the DNS Transaction ID field, which might allow remote attackers to spoof DNS responses by guessing the field value.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
C-Ares DNS库远程缓存破坏漏洞
Vulnerability Description
c-ares是用于异步执行DNS请求和名称解析的C库。 c-ares在生成请求字段值的方式上存在漏洞，远程攻击者可能利用此漏洞破坏DNS缓存。 c-ares库的实现所使用的DNS "Transaction ID"字段基于伪随机数，随连续调用而递增，因此是可预测的。如果用户猜测到了有效的ID，就可能破坏使用c-ares库的应用程序的DNS缓存，执行中间人攻击。
CVSS Information
N/A
Vulnerability Type
N/A