FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-2469

This CVE name corresponds to:

Entered	Topic
2008-10-27	libspf2 -- Buffer overflow

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-2469 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-2469
Phase	Assigned(20080528)

Description

Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitrary code via a long DNS TXT record with a modified length field.

References

Source	Reference
MILW0RM	6805
MISC	http://www.doxpara.com/?p=1263
MISC	http://www.doxpara.com/?page_id=1256
CONFIRM	http://bugs.gentoo.org/show_bug.cgi?format=multiple&id=242254
CONFIRM	https://answers.launchpad.net/ubuntu/gutsy/+source/libspf2/1.2.5.dfsg-4ubuntu0.7.10.1
CONFIRM	https://bugs.launchpad.net/ubuntu/feisty/+source/libspf2/+bug/271025
CONFIRM	http://up2date.astaro.com/2008/11/up2date_7305_released.html
DEBIAN	DSA-1659
GENTOO	GLSA-200810-03
CERT-VN	VU#183657
BID	31881
SECUNIA	32720
VUPEN	ADV-2008-2896
SECUNIA	32496
SECUNIA	32450
SECUNIA	32396
SREASON	4487
XF	libspf2-dnstxtrecord-bo(46055)