« Volver al listado

CVE-2017-1000381

Estado: ModificadaAlta (7.5)—

The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

C-ares — C-aresC-ares Project — C-aresNodejs — Node.js

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-1000381",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-07-07T17:29:00.307",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/99148",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://c-ares.haxx.se/0616.patch",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://c-ares.haxx.se/adv_20170620.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/99148",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://c-ares.haxx.se/0616.patch",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://c-ares.haxx.se/adv_20170620.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way."
    },
    {
      "lang": "es",
      "value": "La función \"ares_parse_naptr_reply()\" de c-ares, que es usada para analizar las respuestas NAPTR, podría ser activada para leer la memoria fuera del búfer de entrada dado si el pasado en el paquete de respuesta DNS fue creado de una manera particular."
    }
  ],
  "lastModified": "2026-06-17T00:59:04.233",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:c-ares:c-ares:1.8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7BDB0FC-AA36-4C41-B3DC-201F0DE0191A"
            },
            {
              "criteria": "cpe:2.3:a:c-ares:c-ares:1.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B38F8E2-7710-4303-A80F-9009619BEC7B"
            },
            {
              "criteria": "cpe:2.3:a:c-ares:c-ares:1.9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA1637EF-3393-4770-91AE-89EA53D57830"
            },
            {
              "criteria": "cpe:2.3:a:c-ares:c-ares:1.10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93FA2559-0DB1-49BE-A6E6-C73408F4AB57"
            },
            {
              "criteria": "cpe:2.3:a:c-ares:c-ares:1.12.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B92EADF5-3500-4F37-808E-41DC48DE8D68"
            },
            {
              "criteria": "cpe:2.3:a:c-ares_project:c-ares:1.11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8F4F4BD-4316-4CB2-8FCE-9EE5C59E64EA"
            },
            {
              "criteria": "cpe:2.3:a:c-ares_project:c-ares:1.11.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "476034B6-69BF-4130-8139-D5DDC1EB0028"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A47FC4F7-1F77-4314-B4B3-3C5D8E335379",
              "versionEndIncluding": "4.1.2",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC1070A7-E3E0-423C-A73A-040FCED8AD96",
              "versionEndExcluding": "4.8.4",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "121E5D5D-B4D9-43F3-B5C9-74590192FAF1",
              "versionEndIncluding": "5.12.0",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D107EC29-67E7-40C3-8E5A-324C9105C5E4",
              "versionEndIncluding": "6.8.1",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6EA3B1B4-3576-4508-AC77-4AE3A5622E09",
              "versionEndExcluding": "6.11.1",
              "versionStartIncluding": "6.9.0"
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9C02D94-B713-4BE4-8C26-F21C2ADC01B0",
              "versionEndExcluding": "7.10.1",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02C6E585-2704-4EC2-BED1-CF6D61BE9CC9",
              "versionEndExcluding": "8.1.4",
              "versionStartIncluding": "8.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}