OSVDB ID: 11180

Title: Libxml2 DNS Reply Overflows

Info

Disclosure
Oct 26, 2004

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 Remote overflows exist in Libxml2. libxml's nanoftp.c xmlNanoFTPConnect() and nanohttp.c xmlNanoHTTPConnectHost() functions fail to properly perform boundary checking of DNS replies, an issue that could potentially cause stack-based overflows. Using specially-crafted DNS replies, an attacker that has hijacked or is controlling a DNS server can cause a denial of service or execute arbitrary code, resulting in a loss of availability or integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity, Loss of Availability
Exploit: Exploit Unknown
Disclosure: Vendor Verified

Solution

 Upgrade to version 2.6.15 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Daniel Veillard

Libxml2

 2.6.14
2.6.13
2.6.12
2.6.11
2.6.10
2.6.9
2.6.8
2.6.7
2.6.6

References

Credit
  • infamous41md - infamous41mdhotpop.com -


Direct URL: http://osvdb.org/11180