FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

glibc -- getaddrinfo stack-based buffer overflow

Affected packages
linux_base-c6 < 6.7_1
linux_base-c6_64 < 6.7_1
0 <= linux_base-f10


VuXML ID 2dd7e97e-d5e8-11e5-bcbd-bc5ff45d0f28
Discovery 2016-02-16
Entry 2016-02-18

Fabio Olive Leite reports:

A stack-based buffer overflow was found in libresolv when invoked from nss_dns, allowing specially crafted DNS responses to seize control of EIP in the DNS client. The buffer overflow occurs in the functions send_dg (send datagram) and send_vc (send TCP) for the NSS module when calling getaddrinfo with AF_UNSPEC family, or in some cases AF_INET6 family. The use of AF_UNSPEC (or AF_INET6 in some cases) triggers the low-level resolver code to send out two parallel queries for A and AAAA. A mismanagement of the buffers used for those queries could result in the response of a query writing beyond the alloca allocated buffer created by __res_nquery.


CVE Name CVE-2015-7547
FreeBSD PR ports/207272