Buffer and stack overflow in dnrd-2.19 and older. CAN-2005-2315 CAN-2005-2316 How-To-Repeat: 1) Buffer overflow (CAN-2005-2315) * create a buffer, a DNS packet, bigger than 268 (256+12) bytes. * Fill the buffer with random data. * Clear the Z and QR flags. * Send it to dnrd. * Repeat til dnrd dies. Impact : this could probably be exploited to perform remote execution. However, dnrd runs in an chroot environment and runs as non-root. 2) Infinite recursion causes stack overflow (CAN-2005-2316) * Create a buffer, a DNS packet. * in the QNAME, use Message compression (see rfc 4.1.4). Set the pointer to point on another location in the buffer. * On this new location set another pointer to point pack to the original QNAME location. In other words, its a circular buffer. Dnrd will recurse until the stack is overflowed. To reproduce #2 its important to not have any valid digits between the loops. It must only contain pointers. Impact : crash -> DoS
State Changed From-To: open->closed Committed, thanks!