Critical ldns Vulnerability in Ubuntu Allows Spoofed DNS Responses

A vulnerability in the ldns library affects Ubuntu systems, allowing remote attackers to inject arbitrary DNS responses due to improper validation of DNS responses when used as a stub resolver over UDP. Discovered by Pablo Ruiz, this issue impacts multiple Ubuntu LTS versions, including 26.04, 24.04, 22.04, 20.04, 18.04, and 16.04. Users are advised to update their systems to the latest package versions to mitigate the risk. The vulnerability poses a significant threat as it could facilitate various attacks, including phishing and man-in-the-middle attacks. Ubuntu Pro users have access to extended security maintenance for affected packages. A standard system update will address the vulnerability across all impacted versions. The issue is currently being monitored, and users are encouraged to take immediate action.

Key Points: • A critical vulnerability in the ldns library allows for spoofed DNS responses. • Affected Ubuntu versions include 26.04, 24.04, 22.04, 20.04, 18.04, and 16.04. • Users should update to the latest package versions to mitigate risks.