The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation.
La herramienta de resolución de zonas stub de DNS en la librería GNU C, también conocida como glibc o libc6, en sus versiones anteriores a la 2.26 cuando el soporte EDNS está activado, solicitará respuestas UDP de gran tamaño de servidores de nombres, pudiendo simplificar los ataques de suplantación de DNS debido a una fragmentación de IP.
Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to hang or crash, resulting in a denial of service. It was discovered that the GNU C Library did not properly handled DNS responses when ENDS0 is enabled. An attacker could possibly use this issue to cause fragmentation-based attacks.
