[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 1 Jun 2020 09:24:21 +0300
From: Georgi Guninski <gguninski@...il.com>
To: oss-security@...ts.openwall.com
Subject: Exploitability of the integer overflows in djbdns 1.05?
From my blog:
https://j.ludost.net/blog/archives/2020/06/01/exploitability_of_the_integer_overflows_in_djbdns_1_05/index.html
Exploitability of the integer overflows in djbdns 1.05?
TLDR: Are the integer overflows in djbdns 1.05 exploitable?
Background: there are integer overflows and memory corruption
in the library functions of qmail 1.03.
For reference see [1] [2].
Some of the qmail vulnerabilities (integer overflows and negative index???)
are present in djbdns 1.05.
For example in alloc.c of djbdns:
====
/*@...l@...*@out@...har *alloc(n)
unsigned int n;
{
char *x;
n = ALIGNMENT + n - (n & (ALIGNMENT - 1)); /* XXX: could overflow */
=====
This clearly overflows for n= -1 for example.
It is natural to write an integer overflow, but
documenting easy to fix security bug is beyond
our understanding.
Reachability of the bugs is not clear and might require
gigabytes of memory to hit the problems by encoding
integer in unary.
In addition djbns limits the memory usage by |softlimit|,
but we are not sure the limits are on all vulnerable
programs. An island of tractability could be |alloc(atoi())|
or |alloc(size * count)|
Is djbdns exploitable by any of the qmail bugs?
[1] http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html
[2] https://www.openwall.com/lists/oss-security/2020/05/19/8
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
