CVE-2016-5180: out-of-bounds write in ares_create_query and ares_mkquery

[Gregor Jasny]

A new upstream version of c-ares has been released which addresses a
security vulnerability.

From: Daniel Stenberg <email address hidden>
Date: Thu, 29 Sep 2016 16:02:10 +0200 (CEST)

`ares_create_query` single byte out of buffer write
=================================================

Project c-ares Security Advisory, September 29, 2016 -
[Permalink](https://c-ares.haxx.se/adv_20160929.html)

VULNERABILITY
-------------

When a string is passed in to `ares_create_query` or `ares_mkquery` and uses
an escaped trailing dot, like "hello\.", c-ares calculates the string length
wrong and subsequently writes outside of the the allocated buffer with one
byte. The wrongly written byte is the least significant byte of the 'dnsclass'
argument; most commonly 1.

We have been seen proof of concept code showing how this can be exploited in a
real-world system, but we are not aware of any such instances having actually
happened in the wild.

INFO
----

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2016-5180 to this issue.

AFFECTED VERSIONS
-----------------

This flaw exists in the following c-ares versions.

- Affected versions: libcurl 1.0.0 to and including 1.11.0
- Not affected versions: c-ares >= 1.12.0

[Gregor Jasny (gjasny)]

For Debian I provided the following updates:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=839151#23

[Emily Ratliff (emilyr)]

Thanks for reporting this bug/CVE. It has been added to the Ubuntu CVE tracker and a package update will be prepared for it. Since the CVE is public, I'm marking the bug public as well.

[Launchpad Janitor (janitor)]

This bug was fixed in the package c-ares - 1.7.5-1ubuntu0.1

---------------
c-ares (1.7.5-1ubuntu0.1) precise-security; urgency=medium

  * SECURITY UPDATE: denial of service and possible execution via hostname
    with an escaped trailing dot (LP: #1629085)
    - debian/patches/CVE-2016-5180.patch: properly handle escaped dot in
      ares_mkquery.c.
    - CVE-2016-5180

 -- Marc Deslauriers <email address hidden> Thu, 06 Oct 2016 10:23:45 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package c-ares - 1.10.0-2ubuntu0.1

---------------
c-ares (1.10.0-2ubuntu0.1) trusty-security; urgency=medium

  * SECURITY UPDATE: denial of service and possible execution via hostname
    with an escaped trailing dot (LP: #1629085)
    - debian/patches/CVE-2016-5180.patch: properly handle escaped dot in
      ares_create_query.c.
    - CVE-2016-5180

 -- Marc Deslauriers <email address hidden> Thu, 06 Oct 2016 10:15:41 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package c-ares - 1.10.0-3ubuntu0.1

---------------
c-ares (1.10.0-3ubuntu0.1) xenial-security; urgency=medium

  * SECURITY UPDATE: denial of service and possible execution via hostname
    with an escaped trailing dot (LP: #1629085)
    - debian/patches/CVE-2016-5180.patch: properly handle escaped dot in
      ares_create_query.c.
    - CVE-2016-5180

 -- Marc Deslauriers <email address hidden> Thu, 06 Oct 2016 10:15:11 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package c-ares - 1.11.0-1ubuntu0.1

---------------
c-ares (1.11.0-1ubuntu0.1) yakkety-security; urgency=medium

  * SECURITY UPDATE: denial of service and possible execution via hostname
    with an escaped trailing dot (LP: #1629085)
    - debian/patches/CVE-2016-5180.patch: properly handle escaped dot in
      ares_create_query.c.
    - CVE-2016-5180

 -- Marc Deslauriers <email address hidden> Thu, 06 Oct 2016 10:08:23 -0400