C-ares CVE-2017-1000381 Out of Bounds Read Information Disclosure Vulnerability

Bugtraq ID:	99148
Class:	Design Error
CVE:	CVE-2017-1000381
Remote:	Yes
Local:	No
Published:	Jun 20 2017 12:00AM
Updated:	Jul 28 2017 05:08PM
Credit:	LCatro
Vulnerable:	Redhat Enterprise Linux Server 5 IBM SDK for Node.js 4.8.3 IBM SDK for Node.js 8.1.2.0 IBM SDK for Node.js 6.11.0.0 Daniel Stenberg c-ares 1.12 Daniel Stenberg c-ares 1.9 Daniel Stenberg c-ares 1.8
Not Vulnerable:	IBM SDK for Node.js 4.8.4 IBM SDK for Node.js 8.1.4.0 IBM SDK for Node.js 6.11.1.0 Daniel Stenberg c-ares 1.13

C-ares CVE-2017-1000381 Out of Bounds Read Information Disclosure Vulnerability

C-ares is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Failed exploit attempts will result in denial-of-service conditions.

c-ares version 1.8.0 through 1.12.0 are vulnerable.

C-ares CVE-2017-1000381 Out of Bounds Read Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

C-ares CVE-2017-1000381 Out of Bounds Read Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

C-ares CVE-2017-1000381 Out of Bounds Read Information Disclosure Vulnerability

References:

• [SECURITY ADVISORY] c-ares NAPTR parser out of bounds access (Seclists.org)
  
• CVE-2017-1000381 (Redhat)
  
• Bug 1463132 - (CVE-2017-1000381) CVE-2017-1000381 c-ares: NAPTR parser out of b (Red Hat)
  
• c-ares NAPTR parser out of bounds access (c-ares.haxx.se)
  
• swg22006298: Multiple vulnerabilities might affect IBM SDK for Node.js (IBM)