The attached PoC causes a remote heap smash in mydns 1.1.0, the bug is
found
within the dynamic update code (update.c). Exploitation requires update
privs
(which tends not to matter too much if you know an IP address with
privileges to do so), also allow-update = yes must be set in
/etc/mydns.conf.
The attached patch also fixes a stack based off-by-one overflow in
update.c.
Example :-
0xb7f27410 in __kernel_vsyscall
()
(gdb) c
Continuing.
Program received signal SIGSEGV, Segmentation fault.
0x0805d0e2 in ?? ()
(gdb) x/i $eip
0x805d0e2 <strcpy at plt+73534>: rep movsb %ds:(%esi),%es:(%edi)
PoC: http://www.digit-labs.org/files/exploits/mydns-rr-smash.c
Patch: http://www.digit-labs.org/files/patches/mydns-update.c.diff
--
mu-b
(mu-b at digit-labs.org)
"Only a few people will follow the proof. Whoever does will
spend the rest of his life convincing people it is correct."
- Anonymous, "P ?= NP"
Feedback :
If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.