CVE-2017-1000381 Amazon Linux Security Advisory for c-ares: ALAS-2017-859

The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. ( CVE-2017-1000381 )

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.

Please refer to Amazon advisory ALAS-2017-859 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2017-859: Amazon Linux (c-ares (1.13.0-1.5.amzn1) on i686)

ALAS-2017-859: Amazon Linux (c-ares (1.13.0-1.5.amzn1) on x86_64)

ALAS-2017-859: Amazon Linux (c-ares (1.13.0-1.5.amzn1) on src)