The attached PoC causes a remote heap smash in mydns 1.1.0, the bug is found within the dynamic update code (update.c). Exploitation requires update privs (which tends not to matter too much if you know an IP address with privileges to do so), also allow-update = yes must be set in /etc/mydns.conf. The attached patch also fixes an stack based off-by-one overflow in update.c. Example :- 0xb7f27410 in __kernel_vsyscall () (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. 0x0805d0e2 in ?? () (gdb) x/i $eip 0x805d0e2 <strcpy@plt+73534>: rep movsb %ds:(%esi),%es:(%edi) PoC: http://www.digit-labs.org/files/exploits/mydns-rr-smash.c Patch: http://www.digit-labs.org/files/patches/mydns-update.c.diff Reproducible: Always Steps to Reproduce:
*** Bug 176281 has been marked as a duplicate of this bug. ***
Thx for the notification mu-b. Matsuu please advise and patch as necessary.
mydns-1.1.0-r1 in cvs. the patch is from debian. http://packages.debian.org/unstable/net/mydns-mysql
Thx for the quick response Matsuu. Arches please test and mark stable. Target keywords are: mydns-1.1.0-r1.ebuild:KEYWORDS="alpha ~amd64 ~hppa ia64 ~ppc sparc x86"
ia64 + x86 stable
sparc stable.
alpha stable.
This one is ready for GLSA vote. I tend to vote NO.
/vote NO.
vote no too - feel free to reopen if you disagree
*** Bug 202571 has been marked as a duplicate of this bug. ***
