Attachment 633222 Details for Bug 869953 – dkim-dns-buffer-overflow-protection-patch

[patch] dkim-dns-buffer-overflow-protection-patch

0001-SECURITY-DKIM-DNS-buffer-overflow-protection.patch (text/plain), 2.13 KB, created by Huzaifa S. Sidhpurwala on 2012-10-25 08:26:41 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Huzaifa S. Sidhpurwala

Created: 2012-10-25 08:26:41 UTC

Size: 2.13 KB

patch

obsolete

>From 4263f395efd136dece52d765dfcff3c96f17506e Mon Sep 17 00:00:00 2001
>From: Phil Pennock <pdp@exim.org>
>Date: Wed, 24 Oct 2012 23:26:29 -0400
>Subject: [PATCH 1/3] SECURITY: DKIM DNS buffer overflow protection
>
>CVE-2012-5671
>
>malloc/heap overflow, with a 60kB window of overwrite.
>Requires DNS under control of person sending email, leaves plenty of
>evidence, but is very likely exploitable on OSes that have not been
>well hardened.
>---
> doc/doc-txt/ChangeLog |    8 ++++++++
> src/src/dkim.c        |    3 +++
> src/src/pdkim/pdkim.h |    4 ++--
> 3 files changed, 13 insertions(+), 2 deletions(-)
>
>diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
>index 6c0554b..bc2fbc6 100644
>--- a/doc/doc-txt/ChangeLog
>+++ b/doc/doc-txt/ChangeLog
>@@ -1,6 +1,14 @@
> Change log file for Exim from version 4.21
> -------------------------------------------
> 
>+Exim version 4.80.1
>+-------------------
>+
>+PP/01 SECURITY: protect DKIM DNS decoding from remote exploit.
>+      CVE-2012-5671
>+      This, or similar/improved, will also be change PP/11 of 4.81.
>+
>+
> Exim version 4.80
> -----------------
> 
>diff --git a/src/src/dkim.c b/src/src/dkim.c
>index 87e91de..05b5fec 100644
>--- a/src/src/dkim.c
>+++ b/src/src/dkim.c
>@@ -42,6 +42,9 @@ int dkim_exim_query_dns_txt(char *name, char *answer) {
>                "%.*s", (int)len, (char *)((rr->data)+rr_offset));
>       rr_offset+=len;
>       answer_offset+=len;
>+      if (answer_offset >= PDKIM_DNS_TXT_MAX_RECLEN) {
>+        return PDKIM_FAIL;
>+      }
>     }
>   }
>   else return PDKIM_FAIL;
>diff --git a/src/src/pdkim/pdkim.h b/src/src/pdkim/pdkim.h
>index 764cc83..1d364a3 100644
>--- a/src/src/pdkim/pdkim.h
>+++ b/src/src/pdkim/pdkim.h
>@@ -27,8 +27,8 @@
> 
> /* -------------------------------------------------------------------------- */
> /* Length of the preallocated buffer for the "answer" from the dns/txt
>-   callback function. */
>-#define PDKIM_DNS_TXT_MAX_RECLEN    4096
>+   callback function. This should match the maximum RDLENGTH from DNS. */
>+#define PDKIM_DNS_TXT_MAX_RECLEN    (1 << 16)
> 
> /* -------------------------------------------------------------------------- */
> /* Function success / error codes */
>-- 
>1.7.10.3
>
>

Actions: View | Diff

Attachments on bug 869953: 633222