==========================================================================
Ubuntu Security Notice USN-3143-1
November 30, 2016
c-ares vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 16.10
– Ubuntu 16.04 LTS
– Ubuntu 14.04 LTS
– Ubuntu 12.04 LTS
Summary:
c-ares could be made to crash or run programs if it processed a specially
crafted hostname.
Software Description:
– c-ares: library for asynchronous name resolves
Details:
Gzob Qq discovered that c-ares incorrectly handled certain hostnames. A
remote attacker could use this issue to cause applications using c-ares to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.10:
libc-ares2 1.11.0-1ubuntu0.1
Ubuntu 16.04 LTS:
libc-ares2 1.10.0-3ubuntu0.1
Ubuntu 14.04 LTS:
libc-ares2 1.10.0-2ubuntu0.1
Ubuntu 12.04 LTS:
libc-ares2 1.7.5-1ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3143-1
CVE-2016-5180
Package Information:
https://launchpad.net/ubuntu/+source/c-ares/1.11.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/c-ares/1.10.0-3ubuntu0.1
https://launchpad.net/ubuntu/+source/c-ares/1.10.0-2ubuntu0.1
https://launchpad.net/ubuntu/+source/c-ares/1.7.5-1ubuntu0.1
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2
iQIcBAEBCgAGBQJYPxldAAoJEGVp2FWnRL6TlQAP/j1r4KTrUytsNnaGLZjhRwtx
7p0FbQsszUz5R+zOggDBNihMHAkBxXxy8xZBSIgg51hU9SbUgwFOvLs9gsFTWmcK
cXcU6sfwxQpnxzima/6s1xQk1+/xCA5zH1YUbQ+tyEoDBfctscm3N/DbB7ZCTHIC
EtebIAZD6sRm0ETfd9ZKTL1C7edGqYbIciS6V6hyKd7dfbLdaAMzX0G7/foWJ7XH
mjl0ZYgjpG4slzQ1vphfQ82ajtYT3KX9+0x74BkGD1gEPp4NRTnyLRDLWonlntMr
0mdcyou2IEtdmeqa3tpdc3a1yuQaL3YDEs6/ep2K5fUwP0qISvYbvz5HNNzrqVuO
h0w3/KkrAXJQlN3exle87tk3s9FYNFeles7HLYZ4Pcd9lbfdzfjYzqA8WIW2jHG6
l8oM09AxT0okEujGOEycS0E7+ZGt5v5ssjTv2gy1eHcUq4iImAO2jHW7UBXSjOsy
Y5FL7XrrV9VQPlV9LvbTgF96tR02VDafnvCp4nCvbsYbcCoYJ51RKsdKf+Cxsjnp
nP3rFXpEtPhjveEImYVQ6JdQNU2hwTrwHTWDkSsAQqyT4xbq464mMUgsgXENTP6Q
m/BRp6IiozsOYHx1Z3XPzYoqOfBlhB+CGbzA6yc4sYm5DDxME8zMlP1ZE2IJuRvD
RWFNxEMuZD+1S6GK+Fit
=e7GG
—–END PGP SIGNATURE—–
—
