PT-2016-4582 · Nick Mathewson+4 · Libevent+4

Guido Vranken · Publicado 2016-12-31 · Atualizado 2022-01-31 · CVE-2016-10197

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libevent versions prior to 2.1.6-beta

Description The issue allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname. This is related to the search make new function in evdns.c.

Recommendations For versions prior to 2.1.6-beta, update to version 2.1.6-beta or later to resolve the issue. As a temporary workaround, consider restricting the input to the search make new function to prevent empty hostnames.

Exploit

Correção

DoS

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CESA-2017_1104

CESA-2017_1106

CESA-2017_1201

CVE-2016-10197

DLA-824-1

DSA-3789-1

MGASA-2017-0066

RHSA-2017:1104

RHSA-2017:1106

RHSA-2017:1201

RHSA-2017_1104

RHSA-2017_1106

RHSA-2017_1201

SUSE-SU-2018:0200-1

SUSE-SU-2018:0263-1

USN-3228-1

USN-3278-1

Produtos afetados

Centos

Red Hat

Suse

Ubuntu

Libevent

Referências · 74

• 🔥 https://github.com/libevent/libevent/issues/332 · Exploit
• https://github.com/libevent/libevent/commit/ec65c42052d95d2c23d1d837136d1cf1d9ecef9e · Correção
• https://github.com/libevent/libevent/blob/release-2.1.6-beta/ChangeLog · Nota
• https://suse.com/support/update/announcement/2018/suse-su-20180263-1 · Nota
• https://suse.com/security/cve/CVE-2016-10195 · Nota
• https://ubuntu.com/security/CVE-2017-5440 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-3228-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-10196 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-5444 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-5451 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-5430 · Aviso do Fabricante
• https://mozilla.org/en-US/security/advisories/mfsa2017-13 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-5466 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2018:0263-1 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2017-1201.html · Aviso do Fabricante