'libspf2' DNS TXT Record Handling Remote Buffer Overflow Vulnerability

Bugtraq ID:	31881
Class:	Boundary Condition Error
CVE:	CVE-2008-2469
Remote:	Yes
Local:	No
Published:	Oct 21 2008 12:00AM
Updated:	Nov 14 2008 02:14PM
Credit:	Dan Kaminsky
Vulnerable:	libspf2 libspf2 1.2.7 libspf2 libspf2 1.2.6 libspf2 libspf2 1.2.5 libspf2 libspf2 1.2.4 libspf2 libspf2 1.2.3 libspf2 libspf2 1.2.2 libspf2 libspf2 1.2.1 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Astaro Security Gateway 7
Not Vulnerable:	libspf2 libspf2 1.2.8

'libspf2' DNS TXT Record Handling Remote Buffer Overflow Vulnerability

The 'libspf2' library is prone to a remote buffer-overflow vulnerability that stems from a lack of bounds checking when handling specially crafted DNS TXT records.

Remote attackers may exploit this issue to execute arbitrary code in the context of an application using a vulnerable version of the library.

Versions prior to 'libspf2' 1.2.8 are affected.

'libspf2' DNS TXT Record Handling Remote Buffer Overflow Vulnerability

A proof of concept is available.

• /data/vulnerabilities/exploits/31881.pl

'libspf2' DNS TXT Record Handling Remote Buffer Overflow Vulnerability

Solution:
The vendor released libspf2 1.2.8 to address this issue. Please see the references for more information.


Debian Linux 4.0 amd64

• Debian libspf2-2_1.2.5-4+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-2_1. 2.5-4+etch1_amd64.deb


• Debian libspf2-dev_1.2.5-4+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-dev_ 1.2.5-4+etch1_amd64.deb


• Debian spfquery_1.2.5-4+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/spfquery_1.2 .5-4+etch1_amd64.deb

Debian Linux 4.0 ia-32

• Debian libspf2-2_1.2.5-4+etch1_i386.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-2_1. 2.5-4+etch1_i386.deb


• Debian libspf2-dev_1.2.5-4+etch1_i386.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-dev_ 1.2.5-4+etch1_i386.deb


• Debian spfquery_1.2.5-4+etch1_i386.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/spfquery_1.2 .5-4+etch1_i386.deb

Debian Linux 4.0 arm

• Debian libspf2-2_1.2.5-4+etch1_arm.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-2_1. 2.5-4+etch1_arm.deb


• Debian libspf2-dev_1.2.5-4+etch1_arm.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-dev_ 1.2.5-4+etch1_arm.deb


• Debian spfquery_1.2.5-4+etch1_arm.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/spfquery_1.2 .5-4+etch1_arm.deb

Debian Linux 4.0 hppa

• Debian libspf2-2_1.2.5-4+etch1_hppa.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-2_1. 2.5-4+etch1_hppa.deb


• Debian libspf2-dev_1.2.5-4+etch1_hppa.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-dev_ 1.2.5-4+etch1_hppa.deb


• Debian spfquery_1.2.5-4+etch1_hppa.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/spfquery_1.2 .5-4+etch1_hppa.deb

Debian Linux 4.0 sparc

• Debian libspf2-2_1.2.5-4+etch1_sparc.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-2_1. 2.5-4+etch1_sparc.deb


• Debian libspf2-dev_1.2.5-4+etch1_sparc.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-dev_ 1.2.5-4+etch1_sparc.deb


• Debian spfquery_1.2.5-4+etch1_sparc.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/spfquery_1.2 .5-4+etch1_sparc.deb

Debian Linux 4.0 s/390

• Debian libspf2-2_1.2.5-4+etch1_s390.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-2_1. 2.5-4+etch1_s390.deb


• Debian libspf2-dev_1.2.5-4+etch1_s390.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-dev_ 1.2.5-4+etch1_s390.deb


• Debian spfquery_1.2.5-4+etch1_s390.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/spfquery_1.2 .5-4+etch1_s390.deb

Debian Linux 4.0 powerpc

• Debian libspf2-2_1.2.5-4+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-2_1. 2.5-4+etch1_powerpc.deb


• Debian libspf2-dev_1.2.5-4+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-dev_ 1.2.5-4+etch1_powerpc.deb


• Debian spfquery_1.2.5-4+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/spfquery_1.2 .5-4+etch1_powerpc.deb

Debian Linux 4.0 alpha

• Debian libspf2-2_1.2.5-4+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-2_1. 2.5-4+etch1_alpha.deb


• Debian libspf2-dev_1.2.5-4+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-dev_ 1.2.5-4+etch1_alpha.deb


• Debian spfquery_1.2.5-4+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/spfquery_1.2 .5-4+etch1_alpha.deb

Debian Linux 4.0 mipsel

• Debian libspf2-2_1.2.5-4+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-2_1. 2.5-4+etch1_mipsel.deb


• Debian libspf2-dev_1.2.5-4+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-dev_ 1.2.5-4+etch1_mipsel.deb


• Debian spfquery_1.2.5-4+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/spfquery_1.2 .5-4+etch1_mipsel.deb

Debian Linux 4.0 ia-64

• Debian libspf2-2_1.2.5-4+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-2_1. 2.5-4+etch1_ia64.deb


• Debian libspf2-dev_1.2.5-4+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/libspf2-dev_ 1.2.5-4+etch1_ia64.deb


• Debian spfquery_1.2.5-4+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/libs/libspf2/spfquery_1.2 .5-4+etch1_ia64.deb

libspf2 libspf2 1.2.1

• libspf2 libspf2-1.2.8.tar.gz
  http://www.libspf2.org/spf/libspf2-1.2.8.tar.gz

libspf2 libspf2 1.2.2

• libspf2 libspf2-1.2.8.tar.gz
  http://www.libspf2.org/spf/libspf2-1.2.8.tar.gz

libspf2 libspf2 1.2.3

• libspf2 libspf2-1.2.8.tar.gz
  http://www.libspf2.org/spf/libspf2-1.2.8.tar.gz

libspf2 libspf2 1.2.4

• libspf2 libspf2-1.2.8.tar.gz
  http://www.libspf2.org/spf/libspf2-1.2.8.tar.gz

libspf2 libspf2 1.2.5

• libspf2 libspf2-1.2.8.tar.gz
  http://www.libspf2.org/spf/libspf2-1.2.8.tar.gz

libspf2 libspf2 1.2.6

• libspf2 libspf2-1.2.8.tar.gz
  http://www.libspf2.org/spf/libspf2-1.2.8.tar.gz

libspf2 libspf2 1.2.7

• libspf2 libspf2-1.2.8.tar.gz
  http://www.libspf2.org/spf/libspf2-1.2.8.tar.gz

'libspf2' DNS TXT Record Handling Remote Buffer Overflow Vulnerability

References:

• Bug 242254 - mail-filter/libspf2 <1.2.8 DNS response buffer overflow (Robert Buchholz)
  
• DNS TXT Record Parsing Bug in LibSPF2 (Dan Kaminsky)
  
• libspf2 SPF Library Home Page (libspf2)
  
• Up2Date 7.305 Released (Astaro)
  
• Vulnerability Note VU#183657 libspf2 DNS TXT record parsing buffer overflow (US-CERT)