CVE-2017-1000381

Published: Jul 7, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.

Affected (14)

Products: C Ares: C Ares · C Ares Project: C Ares · Nodejs: Node.js

1 product

1 product

1 product

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
C Ares C Ares	Version 1.10.0
C Ares C Ares	Version 1.12.0
C Ares C Ares	Version 1.8.0
C Ares C Ares	Version 1.9.0
C Ares C Ares	Version 1.9.1
C Ares Project C Ares	Version 1.11.0
C Ares Project C Ares	Version 1.11.0 rc1

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 4.0.0 to 4.1.2
Nodejs Node.js	From 5.0.0 to 5.12.0
Nodejs Node.js	From 6.0.0 to 6.8.1
Nodejs Node.js	From 7.0.0 to 7.10.1
Nodejs Node.js	From 8.0.0 to 8.1.4
Nodejs Node.js	From 4.2.0 to 4.8.4
Nodejs Node.js	From 6.9.0 to 6.11.1