CVE-2016-10195

What it actually does

Out-of-bounds stack read in name_parse triggered by attacker-controlled label_len values during DNS name parsing, enabling memory disclosure or process crash.

Why it matters to the business

Applications relying on libevent for event-driven networking (DNS, HTTP proxies, etc.) face remote denial-of-service or information leakage; widespread library use means many services remain exposed years after disclosure.

How an attack unfolds

Attacker sends a crafted DNS response or query containing malformed labels with excessive or negative length fields; the vulnerable name_parse function reads beyond the allocated stack buffer when processing label_len, disclosing adjacent stack memory or causing a crash.

How to fix it

Upgrade libevent to a build containing commit 96f64a022014a208105ead6c8a7066018449d86d (equivalent to 2.1.6-beta or later); rebuild and redeploy all dependent applications; verify no custom static builds remain.

How to confirm the fix worked

Confirm installed libevent version or source contains the referenced commit; recompile dependent software against the fixed library and run regression tests exercising evdns name parsing paths.

Typical attack path

1. Identify services using vulnerable libevent versions for DNS resolution
2. Craft malicious DNS packets with oversized or invalid label lengths
3. Deliver packets to the target over the network
4. Trigger out-of-bounds read in evdns.c name_parse
5. Observe crash for DoS or harvest leaked stack contents for further attacks

How to detect it

Review application and system logs for unexpected crashes or restarts of processes linked against libevent during DNS activity; inspect network captures for anomalous DNS responses with unusual label structures; correlate with process core dumps showing stack corruption near evdns handling.

What your security team should do

• Immediately inventory all systems and containers using libevent and schedule upgrades to the fixed commit
• Prioritize internet-facing services accepting DNS or using evdns
• Add libevent version checks to build pipelines and dependency scanners
• Monitor for new exploit code given public exploit availability