oss-sec mailing list archives
Security advisory for musl libc - remote stack-based buffer overflow in DNS response parsing [CVE-2014-3484]
From: Rich Felker <dalias () libc org>
Date: Fri, 6 Jun 2014 21:53:52 -0400
--- Begin Message --- From: Rich Felker <dalias () libc org>
Date: Fri, 6 Jun 2014 18:57:13 -0400
A remote stack-based buffer overflow has been found in musl libc's dns response parsing code. The overflow can be triggered in programs linked against musl libc and making dns queries via one of the standard interfaces (getaddrinfo, getnameinfo, gethostbyname, gethostbyaddr, etc.) if one of the configured nameservers in resolv.conf is controlled by an attacker, or if an attacker can inject forged udp packets with control over their contents. Denial of service is also possible via a related failure in loop detection. The difficulty of such an attack is likely moderate to high and is most feasible if the attacker has already compromised network infrastructure components (nameservers, routers, etc.). Using a local caching nameserver may mitigate the issue but patching is preferred. Software: musl libc (http://www.musl-libc.org) Affected Versions: 0.9.13 - 1.0.2, 1.1.0, and 1.1.1. Fixed Versions: 1.0.3 and 1.1.2 Bug introduced in commit: http://git.musl-libc.org/cgit/musl/commit/?id=fcc522c92335783293ac19df318415cd97fbf66b Bug fixed in commit: http://git.musl-libc.org/cgit/musl/commit/?id=b3d9e0b94ea73c68ef4169ec82c898ce59a4e30a Patch for all affected versions: musl_dn_expand_overflow_fix_v2.diff (attached)Attachment: musl_dn_expand_overflow_fix_v2.diff
Description:
--- End Message ---
Current thread:
- Security advisory for musl libc - remote stack-based buffer overflow in DNS response parsing [CVE-2014-3484] Rich Felker (Jun 06)