The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4796-1 advisory.

  - The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before     4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which     allows man-in-the-middle attackers to spoof servers via a crafted certificate. (CVE-2016-7099)

  - The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be     triggered to read memory outside of the given input buffer if the passed in DNS response packet was     crafted in a particular way. (CVE-2017-1000381)

  - In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by     Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused     to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of     a buffer cause a miscalculation of the maximum length of the input bytes to be written. (CVE-2018-12115)

  - Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be     convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then     data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the     same server. (CVE-2018-12116)

  - Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of     Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or     HTTPS connections and associated resources alive for a long period of time. (CVE-2018-12122)

  - Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser     for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that     hostname can be spoofed by using a mixed case javascript: (e.g. javAscript:) protocol (other protocols     are not affected). If security decisions are made about the URL based on the hostname, they may be     incorrect. (CVE-2018-12123)

  - The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited     to perform remote code execution. An attack is possible from malicious websites open in a web browser on     the same computer, or another computer with network access to the computer running the Node.js process. A     malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy     checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process     with the debug port active is running on localhost or on a host on the local network, the malicious     website could connect to it as a debugger, and get full code execution access. (CVE-2018-7160)

  - Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a     Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and     Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of     Node.js 6.x (LTS Boron), 8.x (LTS Carbon), and 9.x are vulnerable. All versions of Node.js 10.x     (Current) are NOT vulnerable. (CVE-2018-7167)

  - In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1,     an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive     mode and by sending headers very slowly. This keeps the connection and associated resources alive for a     long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer.
    This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js     release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before     11.10.1. (CVE-2019-5737)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Heap-based buffer overflow in the ares_create_query     function in c-ares 1.x before 1.12.0 allows remote     attackers to cause a denial of service (out-of-bounds     write) or possibly execute arbitrary code via a     hostname with an escaped trailing dot.(CVE-2016-5180)

  - The c-ares function `ares_parse_naptr_reply()`, which     is used for parsing NAPTR responses, could be triggered     to read memory outside of the given input buffer if the     passed in DNS response packet was crafted in a     particular way.(CVE-2017-1000381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the c-ares packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in c-ares. A hostname with an     escaped trailing dot (such as 'hello\.') would have its     size calculated incorrectly, leading to a single byte     written beyond the end of a buffer on the heap. An     attacker able to provide such a hostname to an     application using c-ares, could potentially cause that     application to crash.(CVE-2016-5180)

  - The c-ares function `ares_parse_naptr_reply()`, which     is used for parsing NAPTR responses, could be triggered     to read memory outside of the given input buffer if the     passed in DNS response packet was crafted in a     particular way.(CVE-2017-1000381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the c-ares package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in c-ares. A hostname with an     escaped trailing dot (such as 'hello\\.') would have     its size calculated incorrectly, leading to a single     byte written beyond the end of a buffer on the heap. An     attacker able to provide such a hostname to an     application using c-ares, could potentially cause that     application to crash.(CVE-2016-5180)

  - The c-ares function `ares_parse_naptr_reply()`, which     is used for parsing NAPTR responses, could be triggered     to read memory outside of the given input buffer if the     passed in DNS response packet was crafted in a     particular way.(CVE-2017-1000381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs4 and nodejs6 fixes the following issues:
Security issues fixed :

  - CVE-2017-1000381: The c-ares function     ares_parse_naptr_reply() could be triggered to read     memory outside of the given input buffer if the passed     in DNS response packet was crafted in a particular way.
    (bsc#1044946)

  - CVE-2017-11499: Disable V8 snapshots. The hashseed     embedded in the snapshot is currently the same for all     runs of the binary. This opens node up to collision     attacks which could result in a Denial of Service. We     have temporarily disabled snapshots until a more robust     solution is found. (bsc#1048299) Non-security fixes :

  - GCC 7 compilation fixes for v8 backported and add     missing ICU59 headers (bsc#1041282)

  - New upstream LTS release 6.11.1     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V6.md#6 .11.1

  - New upstream LTS release 6.11.0     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V6.md#6 .11.0

  - New upstream LTS release 6.10.3     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V6.md#6 .10.3

  - New upstream LTS release 6.10.2     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V6.md#6 .10.2

  - New upstream LTS release 6.10.1     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V6.md#6 .10.1

  - New upstream LTS release 6.10.0     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V6.md#6 .10.0

  - New upstream LTS release 4.8.4     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V4.md#4 .8.4

  - New upstream LTS release 4.8.3     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V4.md#4 .8.3

  - New upstream LTS release 4.8.2     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V4.md#4 .8.2

  - New upstream LTS release 4.8.1     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V4.md#4 .8.1

  - New upstream LTS release 4.8.0     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V4.md#4 .8.0

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that c-ares incorrectly handled certain NAPTR responses. A remote attacker could possibly use this issue to cause applications using c-ares to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs4 and nodejs6 fixes the following issues :

Security issues fixed :

  - CVE-2017-1000381: The c-ares function     ares_parse_naptr_reply() could be triggered to read     memory outside of the given input buffer if the passed     in DNS response packet was crafted in a particular way.
    (bsc#1044946)

  - CVE-2017-11499: Disable V8 snapshots. The hashseed     embedded in the snapshot is currently the same for all     runs of the binary. This opens node up to collision     attacks which could result in a Denial of Service. We     have temporarily disabled snapshots until a more robust     solution is found. (bsc#1048299)

Non-security fixes :

  - GCC 7 compilation fixes for v8 backported and add     missing ICU59 headers (bsc#1041282)

  - New upstream LTS release 6.11.1

  - https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.1

  - New upstream LTS release 6.11.0

  - https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.0

  - New upstream LTS release 6.10.3

  - https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.3

  - New upstream LTS release 6.10.2

  - https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.2

  - New upstream LTS release 6.10.1

  - https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.1

  - New upstream LTS release 6.10.0

  - https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.0

  - New upstream LTS release 4.8.4

  - https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.4

  - New upstream LTS release 4.8.3

  - https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.3

  - New upstream LTS release 4.8.2

  - https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.2

  - New upstream LTS release 4.8.1

  - https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.1

  - New upstream LTS release 4.8.0

  - https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.0

This update was imported from the SUSE:SLE-12:Update update project.

New version, security fix for CVE-2017-1000381.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

[Security update](https://nodejs.org/en/blog/vulnerability/july-2017-security-re leases/)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. ( CVE-2017-1000381 )

- CVE-2017-1000381: c-ares NAPTR parser out of bounds     access

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libcares2 fixes the following issues :

  - CVE-2017-1000381: A NAPTR parser out of bounds access     was fixed that could lead to crashes. (bsc#1044946)

This update was imported from the SUSE:SLE-12:Update update project.

This update for libcares2 fixes the following issues :

  - CVE-2017-1000381: A NAPTR parser out of bounds access     was fixed that could lead to crashes. (bsc#1044946)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-1000381 The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.

For Debian 7 'Wheezy', these problems have been fixed in version 1.9.1-3+deb7u2.

We recommend that you upgrade your c-ares packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183156	Ubuntu 16.04 ESM / 18.04 ESM : Node.js vulnerabilities (USN-4796-1)	Nessus	Ubuntu Local Security Checks	high
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
135642	EulerOS Virtualization 3.0.2.2 : c-ares (EulerOS-SA-2020-1480)	Nessus	Huawei Local Security Checks	critical
129210	EulerOS 2.0 SP3 : c-ares (EulerOS-SA-2019-2017)	Nessus	Huawei Local Security Checks	critical
128953	EulerOS Virtualization for ARM 64 3.0.2.0 : c-ares (EulerOS-SA-2019-1950)	Nessus	Huawei Local Security Checks	critical
128890	EulerOS 2.0 SP2 : c-ares (EulerOS-SA-2019-1838)	Nessus	Huawei Local Security Checks	critical
128097	EulerOS 2.0 SP5 : c-ares (EulerOS-SA-2019-1805)	Nessus	Huawei Local Security Checks	critical
120002	SUSE SLES12 Security Update : nodejs4, nodejs6 (SUSE-SU-2017:2168-1)	Nessus	SuSE Local Security Checks	high
102583	Ubuntu 14.04 LTS / 16.04 LTS : c-ares vulnerability (USN-3395-1)	Nessus	Ubuntu Local Security Checks	high
102564	openSUSE Security Update : nodejs4 / nodejs6 (openSUSE-2017-948)	Nessus	SuSE Local Security Checks	high
102100	Fedora 26 : mingw-c-ares (2017-7c9a5b4791)	Nessus	Fedora Local Security Checks	high
102098	Fedora 25 : mingw-c-ares (2017-05254795cf)	Nessus	Fedora Local Security Checks	high
102005	Fedora 24 : 1:nodejs (2017-aa44293a53)	Nessus	Fedora Local Security Checks	high
102001	Fedora 25 : 1:nodejs (2017-81522ac6d8)	Nessus	Fedora Local Security Checks	high
101934	Amazon Linux AMI : c-ares (ALAS-2017-859)	Nessus	Amazon Linux Local Security Checks	high
101918	Fedora 26 : 1:nodejs (2017-7c1621d2e8)	Nessus	Fedora Local Security Checks	high
101863	Fedora 24 : c-ares (2017-4932c9b886)	Nessus	Fedora Local Security Checks	high
101653	Fedora 26 : c-ares (2017-6dc3fd198d)	Nessus	Fedora Local Security Checks	high
101543	openSUSE Security Update : libcares2 (openSUSE-2017-810)	Nessus	SuSE Local Security Checks	high
101290	SUSE SLED12 / SLES12 Security Update : libcares2 (SUSE-SU-2017:1792-1)	Nessus	SuSE Local Security Checks	high
101096	Fedora 25 : c-ares (2017-ba1399832b)	Nessus	Fedora Local Security Checks	high
101006	Debian DLA-998-1 : c-ares security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-1000381

high

Tenable Plugins

high

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high