Memory Exfiltration Vulnerability in c-ares DNS Library by Haxx

CVE-2017-1000381

What is CVE-2017-1000381?

The c-ares DNS library function 'ares_parse_naptr_reply()' is susceptible to memory exfiltration. An attacker can exploit this vulnerability by crafting a malicious DNS response packet, which could result in the function reading memory beyond the input buffer. This can potentially allow unauthorized access to sensitive information, leading to further attacks on the system. Users of affected versions of c-ares are advised to update their software to mitigate risks associated with this vulnerability.

References