Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 24 Feb 2009 20:29:03 -0500 (EST)
From: "Steven M. Christey" <>
Subject: new dns2tcp buffer overflow in 0.4.2?

Various vuln databases reported a dns2tcp issue in November, including:

Specifically, a buffer overflow in dns_decode() credited to John Lampe.

This does not line up with CVE-2008-3910, which was supposedly fixed in

Other databases point here:

which is only a fix to a changelog.  But for 0.4.2, the information is
"Suppressed."  For 0.4.3 there's "Fix unsigned int pb and error in
dns_decode (John Lampe)" but may be irrelevant since the claim is that the
issu was fixed in 0.4.2.

This Debian bug ID seems the relevant one:

which at least says "dns_decode.c contains a security flaw fixed in

Can anyone confirm whether this is genuinely different from CVE-2008-3910?


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.