mydns-1.1.0 remote heap overflow

2007.05.04
Credit: mu-b
Risk: Medium
Local: Yes
Remote: Yes
CWE: N/A


CVSS Base Score: 9/10
Impact Subscore: 10/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

The attached PoC causes a remote heap smash in mydns 1.1.0, the bug is found within the dynamic update code (update.c). Exploitation requires update privs (which tends not to matter too much if you know an IP address with privileges to do so), also allow-update = yes must be set in /etc/mydns.conf. The attached patch also fixes a stack based off-by-one overflow in update.c. Example :- 0xb7f27410 in __kernel_vsyscall () (gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. 0x0805d0e2 in ?? () (gdb) x/i $eip 0x805d0e2 <strcpy at plt+73534>: rep movsb %ds:(%esi),%es:(%edi) PoC: http://www.digit-labs.org/files/exploits/mydns-rr-smash.c Patch: http://www.digit-labs.org/files/patches/mydns-update.c.diff -- mu-b (mu-b at digit-labs.org) "Only a few people will follow the proof. Whoever does will spend the rest of his life convincing people it is correct." - Anonymous, "P ?= NP"


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top