Bug 741024 (CVE-2011-3581) - CVE-2011-3581 ldns: heap overflow flaw in ldns_rr_new_frm_str_internal()
Summary: CVE-2011-3581 ldns: heap overflow flaw in ldns_rr_new_frm_str_internal()
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2011-3581
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 741025 741026
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-09-24 14:06 UTC by Vincent Danen
Modified: 2019-09-29 12:47 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-02-28 15:26:46 UTC
Embargoed:

Attachments (Terms of Use)

Description Vincent Danen 2011-09-24 14:06:06 UTC 
It was reported [1],[2] that the ldns_rr_new_frm_str_internal() function of ldns, when parsing data of unknown RR types ("\#"), suffered from a boundary error.  This could be exploited to cause a heap-based buffer overflow by parsing specially crafted DNS Resource Records, possibly leading to the execution of arbitrary code.

A fix [3] has been committed to ldns trunk.

[1] http://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=403
[2] https://secunia.com/advisories/46153/
[3] http://www.nlnetlabs.nl/bugs-script/attachment.cgi?id=180
Comment 1 Vincent Danen 2011-09-24 14:06:54 UTC 
Created ldns tracking bugs for this issue

Affects: fedora-all [bug 741025]
Affects: epel-all [bug 741026]
Comment 2 Vincent Danen 2011-10-03 17:52:46 UTC 
This has been assigned the name CVE-2011-3581
Comment 3 Paul Wouters 2011-10-06 02:03:03 UTC 
Updates are now in all the testing repos
Comment 4 Jan Lieskovsky 2011-10-06 08:16:15 UTC 
(In reply to comment #3)
> Updates are now in all the testing repos

Brilliant, thanks Paul.
Comment 5 Jan Lieskovsky 2011-10-06 08:22:25 UTC 
The following ldns package updates has been pushed to testing repositories to correct this flaw:
1) ldns-1.6.11-2.fc16,
2) ldns-1.6.11-2.fc15,
3) ldns-1.6.11-2.fc14,
4) ldns-1.6.11-2.el6,
5) ldns-1.6.11-2.el5.

Once they have passed the required amount of testing, they will be pushed to
particular -stable repository.
Comment 6 Paul Wouters 2012-02-28 15:26:46 UTC 
These have made it to stable a long time ago
Note You need to log in before you can comment on or make changes to this bug.