| Summary: | <net-dns/c-ares-1.12.0: `ares_create_query` single byte out of buffer write (CVE-2016-5180) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | blueness |
| Priority: | Normal | Flags: | kensington:
sanity-check+
|
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.openwall.com/lists/oss-security/2016/09/29/13 | ||
| Whiteboard: | B2 [glsa cve] | ||
| Package list: |
=net-dns/c-ares-1.12.0
|
Runtime testing required: | --- |
Affected versions: c-ares 1.0.0 to and including 1.11.0 Not affected versions: c-ares >= 1.12.0 =net-dns/c-ares-1.12.0 is in tree since https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4713589132fe11ec3184fb2602492139ce66ab37 @ Maintainer(s): Can we start stabilization of =net-dns/c-ares-1.12.0? @ Arches, please test and mark stable: =net-dns/c-ares-1.12.0 amd64 stable x86 stable arm stable Stable on alpha. sparc stable ia64 stable ppc stable ppc64 stable Stable for HPPA. New GLSA request filed. @ Maintainer(s): Please drop all ebuilds <net-dns/c-ares-1.12.0 (In reply to Thomas Deutschmann from comment #13) > New GLSA request filed. > > > @ Maintainer(s): Please drop all ebuilds <net-dns/c-ares-1.12.0 done @ Maintainer(s): Thank you for your work! This issue was resolved and addressed in GLSA 201701-28 at https://security.gentoo.org/glsa/201701-28 by GLSA coordinator Aaron Bauman (b-man). |
From ${URL} : `ares_create_query` single byte out of buffer write ================================================= Project c-ares Security Advisory, September 29, 2016 - [Permalink](https://c-ares.haxx.se/adv_20160929.html) VULNERABILITY ------------- When a string is passed in to `ares_create_query` or `ares_mkquery` and uses an escaped trailing dot, like "hello\.", c-ares calculates the string length wrong and subsequently writes outside of the the allocated buffer with one byte. The wrongly written byte is the least significant byte of the 'dnsclass' argument; most commonly 1. We have been seen proof of concept code showing how this can be exploited in a real-world system, but we are not aware of any such instances having actually happened in the wild. INFO ---- The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2016-5180 to this issue. AFFECTED VERSIONS ----------------- This flaw exists in the following c-ares versions. - Affected versions: libcurl 1.0.0 to and including 1.11.0 - Not affected versions: c-ares >= 1.12.0 THE SOLUTION ------------ In version 1.12.0, the function has been corrected and a test case have been added to verify. A [patch for CVE-2016-5180](https://c-ares.haxx.se/CVE-2016-5180.patch) is available. RECOMMENDATIONS --------------- We suggest you take one of the following actions immediately, in order of preference: A - Upgrade c-ares to version 1.12.0 B - Apply the patch to your version and rebuild C - Make *really* sure you don't pass in strings to either of these functions that use escaped trailing dots. TIME LINE --------- It was reported to the c-ares project on September 22 by Gzob Qq. c-ares 1.12.0 was released on September 29 2016, coordinated with the publication of this advisory. CREDITS ------- Thanks to Gzob Qq for the report and to Mattias Nissler for code reviews of the patch. @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.