CVE-2016-5180

A vulnerability was found in c-ares. A hostname with an escaped trailing dot such as "hello\." would have its size calculated incorrectly, leading to a single byte written beyond the end of a buffer on the heap. An attacker able to provide such a hostname to an application using c-ares, could...

Wireshark 2.0.0 2.0.4 - CORBA IDL Dissectors Denial of Service

Wireshark 2.0.0 2.0.4 - CORBA IDL Dissectors Denial of Service GIOP capture Build Information: Version 2.0.3 v2.0.3-0-geed34f0 from master-2.0 Copyright 1998-2016 Gerald Combs and contributors. License GPLv2+: GNU GPL version 2 or later This is free software; see the source for copying conditions...

Wireshark 1.12.0 1.12.12 - NDS Dissector Denial of Service

Wireshark 1.12.0 1.12.12 - NDS Dissector Denial of Service Sample generated with AFL Build Information: TShark 1.12.9 v1.12.9-0-gfadb421 from HEAD Copyright 1998-2015 Gerald Combs and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for...

Fedora Update for c-ares FEDORA-2007-0724

Check for the Version of c-ares OpenVAS Vulnerability Test Fedora Update for c-ares FEDORA-2007-0724 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

Fedora Update for c-ares FEDORA-2007-0724

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

FreeBSD Ports: c-ares

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: c-ares

The remote host is missing an update to the system as announced in the referenced advisory. VID 70ae62b0-16b0-11dc-b803-0016179b2dd5 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Fedora 7 : c-ares-1.4.0-1.fc7 (2007-0724)

There is a vulnerability in c-ares 1.4.0, caused by predictable DNS 'Transaction ID' field in DNS queries and can be exploited to poison the DNS cache of an application using the library if a valid ID is guessed. http://www.vuxml.org/freebsd/70ae62b0-16b0-11dc-b803-0016179b2dd5.html Note that...

[SECURITY] Fedora 7 Update: c-ares-1.4.0-1.fc7

c-ares is a C library that performs DNS requests and name resolves asynchronously. c-ares is a fork of the library named 'ares', written by Greg Hudson at MIT...

C-Ares DNS库远程缓存毒药漏洞

C-Ares DNS库是一款可以执行DNS请求和异步名字解析的C库。 C-Ares DNS库使用安全DNS传送ID存在问题，远程攻击者可以利用漏洞进行DNS缓存"毒药"攻击，可进行中间人和欺骗伪造攻击。 C-Ares DNS库实现使用DNS "Transaction ID"字段使用的pseudo随机号码是递增的，因此可预测，可猜测的DNS "Transaction ID"可导致缓存"毒药"攻击。攻击者借此可以进行拒绝服务，中间人欺骗，伪造站点等攻击。 Daniel Stenberg c-ares 1.3.2 Daniel Stenberg c-ares 1.3.1 Daniel...

FreeBSD : c-ares -- DNS Cache Poisoning Vulnerability (70ae62b0-16b0-11dc-b803-0016179b2dd5)

Secunia reports : The vulnerability is caused due to predictable DNS 'Transaction ID' field in DNS queries and can be exploited to poison the DNS cache of an application using the library if a valid ID is guessed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...

Code injection

c-ares before 1.4.0 uses a predictable seed for the random number generator for the DNS Transaction ID field, which might allow remote attackers to spoof DNS responses by guessing the field value...

CVE-2007-3153

The aresinit:randomizekey function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence Unix rand, which makes it easier for remote attackers to spoof DNS responses by guessing certain values...

Design/Logic Flaw

The aresinit:randomizekey function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence Unix rand, which makes it easier for remote attackers to spoof DNS responses by guessing certain values...

CVE-2007-3152

c-ares before 1.4.0 uses a predictable seed for the random number generator for the DNS Transaction ID field, which might allow remote attackers to spoof DNS responses by guessing the field value...

CVE-2007-3153

The CVE-2007-3153 entry describes a vulnerability in the c-ares library: on non-Windows platforms, ares_init:randomize_key uses a weak random-number source (Unix rand), enabling attackers to spoof DNS responses by guessing values. The issue is linked to multiple advisories and updates (e.g., Fedo...

CVE-2007-3152

CVE-2007-3152 affects c-ares up to 1.4.0, where a predictable seed for the DNS Transaction ID RNG can allow remote attackers to guess IDs and spoof DNS responses. Affected: c-ares

CVE-2007-3152

c-ares before 1.4.0 uses a predictable seed for the random number generator for the DNS Transaction ID field, which might allow remote attackers to spoof DNS responses by guessing the field value...

CVE-2007-3153

The aresinit:randomizekey function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence Unix rand, which makes it easier for remote attackers to spoof DNS responses by guessing certain values...

c-ares -- DNS Cache Poisoning Vulnerability

Secunia reports: The vulnerability is caused due to predictable DNS "Transaction ID" field in DNS queries and can be exploited to poison the DNS cache of an application using the library if a valid ID is guessed...