CVE-2016-5180: ares_create_query single byte out of buffer write
A security vulnerability has been discovered in the c-ares library that is bundled with all versions of Node.js. Due to the difficulty of triggering and making use of this vulnerability we currently consider this a low-severity security flaw for Node.js users.
More information at https://c-ares.haxx.se/adv20160929.html
Other sources
Heap-based buffer overflow in the arescreatequery function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.6.1 - Upgrade
Upgrade
c-aresto a version that resolves this vulnerability.Fixed in 1.12.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-5180?
CVE-2016-5180 has a medium severity level due to its potential for denial of service and arbitrary code execution.
How do I fix CVE-2016-5180?
To fix CVE-2016-5180, upgrade c-ares to version 1.12.0 or later.
Which software versions are affected by CVE-2016-5180?
CVE-2016-5180 affects c-ares versions 1.0.0 through 1.11.0, as well as certain versions of Google Android and Node.js.
What type of vulnerability is CVE-2016-5180?
CVE-2016-5180 is a heap-based buffer overflow vulnerability.
Can CVE-2016-5180 lead to remote code execution?
Yes, CVE-2016-5180 can potentially allow remote attackers to execute arbitrary code.