Security: Remote Buffer Overflow (CVE-2006-4251)

Debian Bug report logs - #398557
Security: Remote Buffer Overflow (CVE-2006-4251)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "debian-bts@spamblock.netzgehirn.de" <debian-bts@spamblock.netzgehirn.de>

To: submit@bugs.debian.org

Subject: Security: Remote Buffer Overflow (CVE-2006-4251)

Date: Tue, 14 Nov 2006 12:14:49 +0100

Package: pdns-recursor
Version: all
Severity: critical
Tags: security, fixed-upstream


CVE-2006-4251:

"
PowerDNS Security Advisory 2006-01: Malformed TCP queries can lead to a buffer 
overflow which might be exploitable
[..]
PowerDNS Recursor 3.1.3 and previous miscalculate the length of incoming TCP 
DNS queries, and will attempt to read up to 4 gigabytes of query into a 65535 
byte buffer. 
We have not verified if this problem might actually lead to a system 
compromise, but are acting on the assumption that it might.
[..]
Impact    Potential remote system compromise.
"

See http://doc.powerdns.com/powerdns-advisory-2006-01.html

Fixed upstream: 
http://wiki.powerdns.com/cgi-bin/trac.fcgi/changeset/915
http://ds9a.nl/tmp/cve-2006-4251.patch

Send a report that this bug log contains spam.