CVE-2016-5180
published 2016-10-03CVE-2016-5180: Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds…
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
8.58%
94.5th percentile
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | — | — |
| c-ares | c-ares | >= 0 < 1.12.0-1 | 1.12.0-1 |
| c-ares | c-ares | >= 0 < 1.12.0-1 | 1.12.0-1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: a hostname with an escaped trailing dot (e.g., 'hello\.') causes ares_create_query to miscalculate buffer size, writing one byte beyond the end of a heap buffer. Any DNS query input containing an escaped trailing dot should be treated as suspicious. ↗
- →The vulnerable function is ares_create_query in c-ares 1.x before 1.12.0. Monitor or audit calls to this function when processing attacker-controlled hostnames. ↗
- ·Affected versions are c-ares 1.x before 1.12.0. Packages on RHEL 5, 6, and 7 (c-ares) and Red Hat Software Collections (nodejs010-c-ares, nodejs010-nodejs) are listed as 'Will not fix', meaning patched packages may not be available from the vendor for those platforms. ↗
- ·Debian fixed the vulnerability in package version 1.12.0-1 across all active releases (bookworm, bullseye, forky, sid, trixie). Confirm installed c-ares version is >= 1.12.0-1 on Debian-based systems. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8MEDIUM
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-29hr-5wcr-whpc: Heap-based buffer overflow in the ares_create_query function in c-ares 1
ghsa_unreviewed·2022-05-14
CVE-2016-5180 [CRITICAL] CWE-787 GHSA-29hr-5wcr-whpc: Heap-based buffer overflow in the ares_create_query function in c-ares 1
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.
OSV
CVE-2016-5180: Heap-based buffer overflow in the ares_create_query function in c-ares 1
osv·2016-10-03·CVSS 9.8
CVE-2016-5180 [CRITICAL] CVE-2016-5180: Heap-based buffer overflow in the ares_create_query function in c-ares 1
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.
Android
CVE-2016-5180: Android Security Bulletin 2017-01-01
CVE: CVE-2016-5180
Severity: HIGH
Affected AOSP versions: 7
vendor_android·2017-01-01·CVSS 9.8
CVE-2016-5180 [CRITICAL] CVE-2016-5180: Android Security Bulletin 2017-01-01
CVE: CVE-2016-5180
Severity: HIGH
Affected AOSP versions: 7
Android Security Bulletin 2017-01-01
CVE: CVE-2016-5180
Severity: HIGH
Affected AOSP versions: 7.0
References: A-32205736
Ubuntu
c-ares vulnerability
vendor_ubuntu·2016-11-30
CVE-2016-5180 c-ares vulnerability
Title: c-ares vulnerability
Summary: c-ares could be made to crash or run programs if it processed a specially
crafted hostname.
Gzob Qq discovered that c-ares incorrectly handled certain hostnames. A
remote attacker could use this issue to cause applications using c-ares to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
c-ares: Single byte out of buffer write
vendor_redhat·2016-09-29·CVSS 9.8
CVE-2016-5180 [CRITICAL] CWE-193 c-ares: Single byte out of buffer write
c-ares: Single byte out of buffer write
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.
A vulnerability was found in c-ares. A hostname with an escaped trailing dot (such as "hello\.") would have its size calculated incorrectly, leading to a single byte written beyond the end of a buffer on the heap. An attacker able to provide such a hostname to an application using c-ares, could potentially cause that application to crash.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For addi
Debian
CVE-2016-5180: c-ares - Heap-based buffer overflow in the ares_create_query function in c-ares 1.x befor...
vendor_debian·2016·CVSS 9.8
CVE-2016-5180 [CRITICAL] CVE-2016-5180: c-ares - Heap-based buffer overflow in the ares_create_query function in c-ares 1.x befor...
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.
Scope: local
bookworm: resolved (fixed in 1.12.0-1)
bullseye: resolved (fixed in 1.12.0-1)
forky: resolved (fixed in 1.12.0-1)
sid: resolved (fixed in 1.12.0-1)
trixie: resolved (fixed in 1.12.0-1)
No detection rules found.
Bugzilla
CVE-2017-1000381 c-ares: NAPTR parser out of bounds access
bugzilla·2017-06-20·CVSS 9.8
CVE-2017-1000381 [CRITICAL] CVE-2017-1000381 c-ares: NAPTR parser out of bounds access
CVE-2017-1000381 c-ares: NAPTR parser out of bounds access
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing
NAPTR responses, could be triggered to read memory outside of the given input
buffer if the passed in DNS response packet was crafted in a particular way.
External References:
https://c-ares.haxx.se/adv_20170620.html
Discussion:
Acknowledgments:
Name: Daniel Stenberg
Upstream: LCatro
---
Created mingw-c-ares tracking bugs for this issue:
Affects: epel-7 [bug 1463133]
Affects: fedora-all [bug 1463135]
Created nodejs tracking bugs for this issue:
Affects: epel-all [bug 1463134]
Affects: fedora-all [bug 1463137]
Affects: openshift-1 [bug 1463136]
---
Patch:
https://c-ares.haxx.se/CVE-2017-1000381.patch
---
That's two CVE's (this and CVE-2016-5180
Bugzilla
CVE-2016-5180 nodejs: c-ares: Single byte out of buffer write [epel-all]
bugzilla·2016-10-27·CVSS 9.8
CVE-2016-5180 [CRITICAL] CVE-2016-5180 nodejs: c-ares: Single byte out of buffer write [epel-all]
CVE-2016-5180 nodejs: c-ares: Single byte out of buffer write [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of
Bugzilla
CVE-2016-5180 nodejs: c-ares: Single byte out of buffer write [fedora-all]
bugzilla·2016-10-27·CVSS 9.8
CVE-2016-5180 [CRITICAL] CVE-2016-5180 nodejs: c-ares: Single byte out of buffer write [fedora-all]
CVE-2016-5180 nodejs: c-ares: Single byte out of buffer write [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fed
Bugzilla
CVE-2016-5180 mingw-c-ares: c-ares: Single byte out of buffer write [epel-7]
bugzilla·2016-09-30·CVSS 9.8
CVE-2016-5180 [CRITICAL] CVE-2016-5180 mingw-c-ares: c-ares: Single byte out of buffer write [epel-7]
CVE-2016-5180 mingw-c-ares: c-ares: Single byte out of buffer write [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-tracking-bugs]
Bugzilla
CVE-2016-5180 mingw-c-ares: c-ares: Single byte out of buffer write [epel-6]
bugzilla·2016-09-29·CVSS 9.8
CVE-2016-5180 [CRITICAL] CVE-2016-5180 mingw-c-ares: c-ares: Single byte out of buffer write [epel-6]
CVE-2016-5180 mingw-c-ares: c-ares: Single byte out of buffer write [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-tracking-bugs]
Bugzilla
CVE-2016-5180 c-ares19: c-ares: Single byte out of buffer write [epel-7]
bugzilla·2016-09-29·CVSS 9.8
CVE-2016-5180 [CRITICAL] CVE-2016-5180 c-ares19: c-ares: Single byte out of buffer write [epel-7]
CVE-2016-5180 c-ares19: c-ares: Single byte out of buffer write [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-tracking-bugs]
Disc
Bugzilla
CVE-2016-5180 mingw-c-ares: c-ares: Single byte out of buffer write [fedora-all]
bugzilla·2016-09-29·CVSS 9.8
CVE-2016-5180 [CRITICAL] CVE-2016-5180 mingw-c-ares: c-ares: Single byte out of buffer write [fedora-all]
CVE-2016-5180 mingw-c-ares: c-ares: Single byte out of buffer write [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
Bugzilla
CVE-2016-5180 c-ares: Single byte out of buffer write
bugzilla·2016-09-29·CVSS 9.8
CVE-2016-5180 [CRITICAL] CVE-2016-5180 c-ares: Single byte out of buffer write
CVE-2016-5180 c-ares: Single byte out of buffer write
When a string is passed in to `ares_create_query` or `ares_mkquery` and uses an escaped trailing dot, like "hello\.", c-ares calculates the string length wrong and subsequently writes outside of the the allocated buffer with one byte. The wrongly written byte is the least significant byte of the 'dnsclass' argument; most commonly 1.
Affected versions: c-ares 1.0.0 to and including 1.11.0
Upstream patch:
https://c-ares.haxx.se/CVE-2016-5180.patch
External References:
https://c-ares.haxx.se/adv_20160929.html
Discussion:
Created c-ares19 tracking bugs for this issue:
Affects: epel-7 [bug 1380468]
---
Created mingw-c-ares tracking bugs for this issue:
Affects: fedora-all [bug 1380465]
Affects: epel-6 [bug 1380467]
---
Created
Bugzilla
CVE-2016-5180 c-ares: Single byte out of buffer write [epel-5]
bugzilla·2016-09-29·CVSS 9.8
CVE-2016-5180 [CRITICAL] CVE-2016-5180 c-ares: Single byte out of buffer write [epel-5]
CVE-2016-5180 c-ares: Single byte out of buffer write [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-tracking-bugs]
Discussion:
Us
Bugzilla
CVE-2016-5180 c-ares: Single byte out of buffer write [fedora-all]
bugzilla·2016-09-29·CVSS 9.8
CVE-2016-5180 [CRITICAL] CVE-2016-5180 c-ares: Single byte out of buffer write [fedora-all]
CVE-2016-5180 c-ares: Single byte out of buffer write [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. Whi
Trailofbits
Binary symbolic execution with KLEE-Native
blogs_trailofbits·2019-08-30
Binary symbolic execution with KLEE-Native
KLEE is a symbolic execution tool that intelligently produces high-coverage test cases by emulating LLVM bitcode in a custom runtime environment. Yet, unlike simpler fuzzers, it’s not a go-to tool for automated bug discovery. Despite constant improvements by the academic community, KLEE remains difficult for bug hunters to adopt. We’re working to bridge this gap!
My internship project focused on KLEE-Native, a fork of KLEE that operates on binary program snapshots by lifting machine code to LLVM bitcode.
## What doesn’t kill you makes you stronger
KLEE’s greatest strength is also its biggest weakness: It operates on LLVM bitcode. The most apparent strength of operating on bitcode is that KLEE can run on anything that the Clang compiler toolchain can compile: C, C++, Swift, Rust, etc. Ho
Trailofbits
Binary symbolic execution with KLEE-Native
blogs_trailofbits·2019-08-30
Binary symbolic execution with KLEE-Native
KLEE is a symbolic execution tool that intelligently produces high-coverage test cases by emulating LLVM bitcode in a custom runtime environment. Yet, unlike simpler fuzzers, it’s not a go-to tool for automated bug discovery. Despite constant improvements by the academic community, KLEE remains difficult for bug hunters to adopt. We’re working to bridge this gap!
My internship project focused on KLEE-Native , a fork of KLEE that operates on binary program snapshots by lifting machine code to LLVM bitcode.
## What doesn’t kill you makes you stronger
KLEE’s greatest strength is also its biggest weakness: It operates on LLVM bitcode. The most apparent strength of operating on bitcode is that KLEE can run on anything that the Clang compiler toolchain can compile: C, C++, Swift, Rust, etc. H
arXiv
P2FAAS: Toward Privacy-Preserving Fuzzing as a Service
arxiv_fulltext·2019-09-24
P2FAAS: Toward Privacy-Preserving Fuzzing as a Service
: Toward Privacy-Preserving Fuzzing \ a Service
Fan Sang, Daehee Jang, Ming-Wei Shih, Taesoo Kim
Georgia Institute of Technology
10002978.10002991.10002995
Security and privacy Privacy-preserving protocols
300
CCSXML
[300]Security and privacy Privacy-preserving protocols
Fuzzing as a Service;
Privacy Preserving Fuzzing;
SGX
## Abstract
Global corporations (e.g., Google and Microsoft) have recently introduced a
new model of cloud services, fuzzing-as-a-service (FaaS).
Despite effectively alleviating the cost of fuzzing,
the model comes with privacy concerns.
For example, the end user has to trust both cloud and service providers
who have access to the application to be fuzzed.
Such concerns are due to the platform is under the control of its provider
and the application and the fu
arXiv
Automatic Techniques to Systematically Discover New Heap Exploitation Primitives
arxiv_fulltext·2019-03-01
Automatic Techniques to Systematically Discover New Heap Exploitation Primitives
Automatic Techniques to Systematically Discover
New Heap Exploitation Primitives
fancyplain
Rev.
\ of LastPage
Insu Yun
Dhaval Kapil
Taesoo Kim
Georgia Institute of Technology
## Abstract
Exploitation techniques
to abuse the metadata of heap allocators
have been widely studied
because of their generality (i.e., application independent)
and powerful capability
(i.e., bypassing mitigation).
However, such techniques
are commonly considered arts,
and thus the approaches to discover them
remain ad-hoc, manual, and allocator-specific at best.
In this paper,
we present an automatic tool,
,
to systematically discover
the unexplored heap exploitation primitives,
regardless of their underlying implementations.
The key idea of
is to let the computer autonomously explore the spaces,
similar
http://rhn.redhat.com/errata/RHSA-2017-0002.htmlhttp://www.debian.org/security/2016/dsa-3682http://www.securityfocus.com/bid/93243http://www.ubuntu.com/usn/USN-3143-1https://c-ares.haxx.se/CVE-2016-5180.patchhttps://c-ares.haxx.se/adv_20160929.htmlhttps://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.htmlhttps://security.gentoo.org/glsa/201701-28https://source.android.com/security/bulletin/2017-01-01.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0002.htmlhttp://www.debian.org/security/2016/dsa-3682http://www.securityfocus.com/bid/93243http://www.ubuntu.com/usn/USN-3143-1https://c-ares.haxx.se/CVE-2016-5180.patchhttps://c-ares.haxx.se/adv_20160929.htmlhttps://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.htmlhttps://security.gentoo.org/glsa/201701-28https://source.android.com/security/bulletin/2017-01-01.html
2016-10-03
Published