PT-2021-30830 · C-Ares · C-Ares

Published 2021-01-08 · Updated 2021-01-08

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions c-ares (affected versions not specified)

Description The issue involves several potential problems, including a read-heap-buffer-overflow in ares parse soa reply discovered through fuzzing, a theoretical buffer overflow in the RC4 loop comparison, and invalid memory access due to an empty hquery->name. Additionally, ares parse {a,aaaa} reply() functions could return a larger *naddrttls than initially passed in.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2021-0007

Affected Products

C-Ares

References · 4

• https://advisories.mageia.org/MGASA-2021-0007.html · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0007 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=27654 · Note
• https://c-ares.haxx.se/changelog.html#1_17_1 · Note