Ubuntu 16.10 USN-3143-1 Critical: c-ares Denial of Service

ubuntu

November 30, 2016

c-ares could be made to crash or run programs if it processed a specially crafted hostname.

Summary

c-ares could be made to crash or run programs if it processed a specially

crafted hostname.

Software Description:

- c-ares: library for asynchronous name resolves

Details:

Gzob Qq discovered that c-ares incorrectly handled certain hostnames. A

remote attacker could use this issue to cause applications using c-ares to

crash, resulting in a denial of service, or possibly execute arbitrary

code.

Topics Covered

security advisory denial of service critical Ubuntu c-ares

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  libc-ares2                      1.11.0-1ubuntu0.1

Ubuntu 16.04 LTS:
  libc-ares2                      1.10.0-3ubuntu0.1

Ubuntu 14.04 LTS:
  libc-ares2                      1.10.0-2ubuntu0.1

Ubuntu 12.04 LTS:
  libc-ares2                      1.7.5-1ubuntu0.1

In general, a standard system update will make all the necessary changes.