bugtraq - MaraDNS denial of service vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070619130028.19821.qmail@securityfocus.com>
Date: 19 Jun 2007 13:00:28 -0000
From: jantunes@...fc.ul.pt
To: bugtraq@...urityfocus.com
Subject: MaraDNS denial of service vulnerabilities

---------------------------------------
Synopsis
----------------------------------------
Product: MaraDNS (http://www.maradns.org)
Affected versions: 1.2.12.05 (stable) and 1.3.04 (testing) and prior versions
Type: Local resource exhaustion / denial of service
Risk: Remote denial of service
Remote: Yes
Discovered by: Joao Antunes (PREDATOR - vulnerability discovery tool) on 8th May 2007
Exploit: Attackers can exploit this issue via DNS queries for reverse lookups or non-Internet class records.
Solution: Upgrade to 1.2.12.06 (stable) or 1.3.05 (testing)
Status: The developers were contacted and a new patched version was released
References: http://www.maradns.org/changelog.html

----------------------------------------
Vulnerability Description
----------------------------------------
MaraDNS 1.2.12.05 (stable) and 1.3.04 (testing) versions are prone to local resource exhaustion vulnerabilities susceptible of causing a denial of service.
DNS requests for reverse lookups (opcode != 0) or non-Internet class records (qclass != 1) queries will cause the server to leak approximately 550 bytes of memory.
This can be exploited by a remote attacker to cause MaraDNS to allocate an arbitrary large amount of memory, thus provoking a remote denial of service when exhausting all the available memory.