FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

maradns -- denial of service when resolving a long DNS hostname

Affected packages
maradns < 1.4.06

Details

VuXML ID 8015600f-2c80-11e0-9cc1-00163e5bf4f9
Discovery 2011-01-23
Entry 2011-01-31

MaraDNS developer Sam Trenholme reports:

... a mistake in allocating an array of integers, allocating it in bytes instead of sizeof(int) units. This resulted in a buffer being too small, allowing it to be overwritten. The impact of this programming error is that MaraDNS can be crashed by sending MaraDNS a single "packet of death". Since the data placed in the overwritten array can not be remotely controlled (it is a list of increasing integers), there is no way to increase privileges exploiting this bug.

References

Bugtraq ID 45966
CVE Name CVE-2011-0520
URL http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610834