CVE-2016-10195
📋 TL;DR
CVE-2016-10195 is a critical out-of-bounds read vulnerability in libevent's DNS parsing function that allows remote attackers to read sensitive data from stack memory. This affects applications using vulnerable libevent versions for DNS resolution. Attackers can potentially leverage this to bypass ASLR or leak sensitive information.
💻 Affected Systems
- libevent
- Applications using libevent for DNS resolution
📦 What is this software?
Libevent by Libevent Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution via information disclosure that bypasses ASLR, leading to complete system compromise.
Likely Case
Information disclosure allowing attackers to read stack memory contents, potentially revealing sensitive data or memory addresses.
If Mitigated
Limited impact if proper network segmentation and application sandboxing are implemented.
🎯 Exploit Status
Exploitation requires sending malicious DNS responses to trigger the out-of-bounds read. Public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libevent 2.1.6-beta and later
Vendor Advisory: http://www.openwall.com/lists/oss-security/2017/01/31/17
Restart Required: Yes
Instructions:
1. Update libevent to version 2.1.6-beta or later. 2. Recompile applications using libevent. 3. Restart affected services.
🔧 Temporary Workarounds
Network filtering
allBlock or filter incoming DNS responses from untrusted sources
Application sandboxing
linuxRun vulnerable applications with reduced privileges and memory restrictions
systemctl edit <service> (add MemoryDenyWriteExecute=true, PrivateTmp=true, etc.)
🧯 If You Can't Patch
- Implement strict network segmentation to limit DNS traffic to trusted sources only
- Deploy application control solutions to monitor and restrict libevent-based applications
🔍 How to Verify
Check if Vulnerable:
Check libevent version: ldd /path/to/application | grep libevent && strings /usr/lib/libevent* | grep 'libevent-'Check Version:
pkg-config --modversion libevent || strings /usr/lib/libevent* | grep 'libevent-' | head -1Verify Fix Applied:
Verify libevent version is 2.1.6-beta or later: pkg-config --modversion libevent📡 Detection & Monitoring
Log Indicators:
- Application crashes or abnormal termination
- DNS parsing errors in application logs
Network Indicators:
- Unusual DNS response patterns to applications
- DNS traffic from unexpected sources
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "out of bounds" OR "libevent")🔗 References
- http://www.debian.org/security/2017/dsa-3789
- http://www.openwall.com/lists/oss-security/2017/01/31/17
- http://www.openwall.com/lists/oss-security/2017/02/02/7
- http://www.securityfocus.com/bid/96014
- http://www.securitytracker.com/id/1038320
- https://access.redhat.com/errata/RHSA-2017:1104
- https://access.redhat.com/errata/RHSA-2017:1106
- https://access.redhat.com/errata/RHSA-2017:1201
- https://github.com/libevent/libevent/blob/release-2.1.6-beta/ChangeLog
- https://github.com/libevent/libevent/commit/96f64a022014a208105ead6c8a7066018449d86d
- https://github.com/libevent/libevent/issues/317
- https://security.gentoo.org/glsa/201705-01
- http://www.debian.org/security/2017/dsa-3789
- http://www.openwall.com/lists/oss-security/2017/01/31/17
- http://www.openwall.com/lists/oss-security/2017/02/02/7
- http://www.securityfocus.com/bid/96014
- http://www.securitytracker.com/id/1038320
- https://access.redhat.com/errata/RHSA-2017:1104
- https://access.redhat.com/errata/RHSA-2017:1106
- https://access.redhat.com/errata/RHSA-2017:1201
- https://github.com/libevent/libevent/blob/release-2.1.6-beta/ChangeLog
- https://github.com/libevent/libevent/commit/96f64a022014a208105ead6c8a7066018449d86d
- https://github.com/libevent/libevent/issues/317
- https://security.gentoo.org/glsa/201705-01
