ByteOS Network

NVD Vulnerability Details :

CVE-2017-1000381

Deferred

Source-cve@mitre.org

Published At-07 Jul, 2017 | 17:29

Updated At-20 Apr, 2025 | 01:37

The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

c-ares>>c-ares>>1.8.0

cpe:2.3:a:c-ares:c-ares:1.8.0:*:*:*:*:*:*:*

c-ares>>c-ares>>1.9.0

cpe:2.3:a:c-ares:c-ares:1.9.0:*:*:*:*:*:*:*

c-ares>>c-ares>>1.9.1

cpe:2.3:a:c-ares:c-ares:1.9.1:*:*:*:*:*:*:*

c-ares>>c-ares>>1.10.0

cpe:2.3:a:c-ares:c-ares:1.10.0:*:*:*:*:*:*:*

c-ares>>c-ares>>1.12.0

cpe:2.3:a:c-ares:c-ares:1.12.0:*:*:*:*:*:*:*

c-ares_project>>c-ares>>1.11.0

cpe:2.3:a:c-ares_project:c-ares:1.11.0:*:*:*:*:*:*:*

c-ares_project>>c-ares>>1.11.0

cpe:2.3:a:c-ares_project:c-ares:1.11.0:rc1:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 4.0.0(inclusive) to 4.1.2(inclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 4.2.0(inclusive) to 4.8.4(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 5.0.0(inclusive) to 5.12.0(inclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 6.0.0(inclusive) to 6.8.1(inclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 6.9.0(inclusive) to 6.11.1(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 7.0.0(inclusive) to 7.10.1(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 8.0.0(inclusive) to 8.1.4(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-200	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.securityfocus.com/bid/99148	cve@mitre.org	Third Party Advisory VDB Entry
https://c-ares.haxx.se/0616.patch	cve@mitre.org	Mailing List Vendor Advisory
https://c-ares.haxx.se/adv_20170620.html	cve@mitre.org	Vendor Advisory
http://www.securityfocus.com/bid/99148	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://c-ares.haxx.se/0616.patch	af854a3a-2127-422b-91ae-364da2661108	Mailing List Vendor Advisory
https://c-ares.haxx.se/adv_20170620.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History