c-ares: Heap-based buffer overflow

Background

c-ares is a C library for asynchronous DNS requests (including name resolves).

Description

A hostname with an escaped trailing dot (such as “hello\.”) would have its size calculated incorrectly leading to a single byte written beyond the end of a buffer on the heap.

Impact

A remote attacker, able to provide a specially crafted hostname to an application using c-ares, could potentially cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All c-ares users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-dns/c-ares-1.12.0"