CVE-2017-1000381
HIGH EPSS 87.0%
Published Jul 7, 20178y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
Published Jul 7, 2017 8y ago
Last Modified Jun 17, 2026 2w ago
Description
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
87.0% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
Affected Products 14
| Vendor | Product | Version | Range |
|---|---|---|---|
| c-ares | c-ares | 1.8.0 | any |
| c-ares | c-ares | 1.9.0 | any |
| c-ares | c-ares | 1.9.1 | any |
| c-ares | c-ares | 1.10.0 | any |
| c-ares | c-ares | 1.12.0 | any |
| c-ares_project | c-ares | 1.11.0 | any |
| c-ares_project | c-ares | 1.11.0 | any |
| nodejs | node.js | * | ≥4.0.0 – ≤4.1.2 |
| nodejs | node.js | * | ≥4.2.0 – <4.8.4 |
| nodejs | node.js | * | ≥5.0.0 – ≤5.12.0 |
| nodejs | node.js | * | ≥6.0.0 – ≤6.8.1 |
| nodejs | node.js | * | ≥6.9.0 – <6.11.1 |
| nodejs | node.js | * | ≥7.0.0 – <7.10.1 |
| nodejs | node.js | * | ≥8.0.0 – <8.1.4 |
References 3
- securityfocus.com http://www.securityfocus.com/bid/99148
- c-ares.haxx.se https://c-ares.haxx.se/0616.patch
- c-ares.haxx.se https://c-ares.haxx.se/adv_20170620.html
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.