Bug 600739

+++ This bug was initially created as a clone of Bug #600738 +++

Maradns upstream, in version v1.4.03 fixed following bug (from
patch changelog):

<begin quote>

This fixes a bug introduced in MaraDNS 1.3.03 (January 2007) when
I allowed '.' to be in a hostname: Hostnames that incorrectily not
end with a dot result in a string being deallocated then used.

MaraDNS 1.2 does not have this issue.

This issue can not be exploited from zones loaded using DNS's zone
transfer mechanism; fetchzone filters data obtained this way.  This issue
can only be exploited in the unusual case of an attacker having control
of the contents of a csv2 zone file to be parsed by MaraDNS.

This issue, on Linux systems, results in a null pointer dereference that
does not appear to be exploitable.

This patch cleanly patches MaraDNS 1.4.02 and against 1.3.07.09.

<end quote>

Red Hat Security Response Team wouldn't consider this to bei a security
issue, as it's just NULL pointer dereference and requires the attacker
to have control of the contenst of a csv2 zone file to be parsed
by MaraDNS (which is quite unlikely). But it's still a bug / deficiency,
which should be addressed.

References:
  [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584587
  [2] http://maradns.org/download/maradns-1.4.02-parse_segfault.patch

--- Additional comment from jlieskov on 2010-06-05 16:27:48 EDT ---

Created an attachment (id=421489)
Local copy of "maradns-1.4.02-parse_segfault.patch" from [2]

While current F-11 version of MaraDNS seems to already contain
some hunks of this patch, Michael, please double-check && rebuild
if necessary (at least first hunk seems applicable).

Thanks, Jan.