PT-2016-6298 · C-Ares+3 · C-Ares+3
Gzob Qq
·
Published
2016-07-15
·
Updated
2024-06-15
·
CVE-2016-5180
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
c-ares versions 1.x before 1.12.0
Description
The issue is related to a heap-based buffer overflow in the
ares create query function, which can be triggered by a remote attacker using a hostname with an escaped trailing dot. This can lead to a denial of service due to an out-of-bounds write or potentially allow the execution of arbitrary code.Recommendations
For versions prior to 1.12.0, update to version 1.12.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of hostnames with escaped trailing dots to minimize the risk of exploitation.
Exploit
Fix
DoS
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Suse
Ubuntu
C-Ares