The attached PoC causes a remote heap smash in mydns 1.1.0, the bug is found
within the dynamic update code (update.c). Exploitation requires update privs
(which tends not to matter too much if you know an IP address with
privileges to do so), also allow-update = yes must be set in /etc/mydns.conf.
The attached patch also fixes an stack based off-by-one overflow in update.c.
0xb7f27410 in __kernel_vsyscall
Program received signal SIGSEGV, Segmentation fault.
0x0805d0e2 in ?? ()
(gdb) x/i $eip
0x805d0e2 <strcpy@plt+73534>: rep movsb %ds:(%esi),%es:(%edi)
Steps to Reproduce:
*** Bug 176281 has been marked as a duplicate of this bug. ***
Thx for the notification mu-b.
Matsuu please advise and patch as necessary.
mydns-1.1.0-r1 in cvs. the patch is from debian.
Thx for the quick response Matsuu.
Arches please test and mark stable. Target keywords are:
mydns-1.1.0-r1.ebuild:KEYWORDS="alpha ~amd64 ~hppa ia64 ~ppc sparc x86"
ia64 + x86 stable
This one is ready for GLSA vote. I tend to vote NO.
vote no too - feel free to reopen if you disagree
*** Bug 202571 has been marked as a duplicate of this bug. ***