Bug 501520 (CVE-2009-1755)

Summary:	CVE-2009-1755 nsd: one-byte buffer overflow in low-level DNS packet decoding routine
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	pwouters
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-05-19 15:01:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2009-05-19 15:01:09 UTC

An one-byte buffer overflow was found in NSD, a complete implementation of an authoritative DNS name server, in one of its low-level DNS packet decoding
routines. An attacker could provide a specially-crafted DNS record to the
NSD DNS name server, leading to a denial of service.

Credit: Ilja van Sprundel of IOActive

References:
http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529420
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529418
http://www.openwall.com/lists/oss-security/2009/05/19/1
http://www.nlnetlabs.nl/downloads/nsd/nsd-3.2.2.tar.gz
http://www.nlnetlabs.nl/downloads/nsd/nsd-3.2.1-vuln.patch
http://www.nlnetlabs.nl/downloads/nsd/nsd-2.3.7-vuln.patch

Comment 1 Jan Lieskovsky 2009-05-19 15:04:24 UTC

The issue was addressed in nsd-3.2.2-1.fc9 version of NSD package,
for Fedora 9.

The issue was addressed in nsd-3.2.2-2.fc10 version of NSD package,
for Fedora 10.

The issue was addressed in nsd-3.2.2-2.fc11 version of NSD package,
for Fedora 11.

Comment 2 Tomas Hoger 2009-05-22 06:14:13 UTC

CVE-2009-1755:
Off-by-one error in packet.c in nsd 3.2.1 and 2.3.7 allows remote
attackers to cause a denial of service (crash) and possibly execute
arbitrary code via unspecified vectors that trigger a buffer overflow.