full-disclosure - mydns-1.1.0 remote heap overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4631B825.7080406@digit-labs.org>
Date: Fri, 27 Apr 2007 09:45:25 +0100
From: mu-b <mu-b@...it-labs.org>
To: full-disclosure@...ts.grok.org.uk
Subject: mydns-1.1.0 remote heap overflow

The attached PoC causes a remote heap smash in mydns 1.1.0, the bug is found
within the dynamic update code (update.c). Exploitation requires update privs
(which tends not to matter too much if you know an IP address with
privileges to do so), also allow-update = yes must be set in /etc/mydns.conf.
The attached patch also fixes a stack based off-by-one overflow in update.c.

Example :-
0xb7f27410 in __kernel_vsyscall
    ()
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x0805d0e2 in ?? ()
(gdb) x/i $eip
0x805d0e2 <strcpy@...+73534>:   rep movsb %ds:(%esi),%es:(%edi)

PoC: http://www.digit-labs.org/files/exploits/mydns-rr-smash.c
Patch: http://www.digit-labs.org/files/patches/mydns-update.c.diff
-- 
mu-b
(mu-b@...it-labs.org)

  "Only a few people will follow the proof. Whoever does will
     spend the rest of his life convincing people it is correct."
        - Anonymous, "P ?= NP"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/