Executive Summary

Summary
Title libspf2 DNS TXT record parsing buffer overflow
Informations
Name VU#183657 First vendor Publication 2008-10-30
Vendor VU-CERT Last vendor Modification 2009-02-17
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#183657

libspf2 DNS TXT record parsing buffer overflow

Overview

libspf2 contains a buffer overflow vulnerability in code that parses DNS TXT records.

I. Description

libspf2 is a widely-deployed implementation of the Sender Policy Framework. According to RFC 4408:

    An SPF record is a DNS Resource Record (RR) that declares which hosts are, and are not, authorized to use a domain name for the "HELO" and "MAIL FROM" identities. Loosely, the record partitions all hosts into permitted and not-permitted sets (though some hosts might fall into neither category).

libspf2 contins a buffer overflow in DNS TXT record parsing. According to Doxpara Research:
    DNS TXT records have long been a little tricky to parse, due to them containing two length fields. First, there is the length field of the record as a whole. Then, there is a sublength field, from 0 to 255, that describes the length of a particular character string inside the larger record. There is nothing that links the two values, and DNS servers to not themselves enforce sanity checks here. As such, there is always a risk that when receiving a DNS TXT record, the outer record length will be the amount allocated, but the inner length will be copied.
This issue is similar to VU#814627"Sendmail vulnerable to buffer overflow when DNS map is specified using TXT records."

II. Impact

This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code on a system running libspf2.

III. Solution

Upgrade

Vendors and those who directly use libspf2 should upgrade to version 1.2.8.

Users that run a mail server or anti-spam products should consult their vendor for an appropriate patch.

Systems Affected

VendorStatusDate NotifiedDate Updated
3com, Inc.Unknown2008-09-162008-09-16
ACCESSUnknown2008-09-162008-09-16
Alcatel-LucentUnknown2008-09-162008-09-16
Apple Computer, Inc.Unknown2008-09-162008-09-16
AT&TUnknown2008-09-162008-09-16
Avaya, Inc.Unknown2008-09-162008-09-16
Barracuda NetworksUnknown2008-09-162008-09-16
Belkin, Inc.Unknown2008-09-162008-09-16
BizangaNot Vulnerable2008-09-172008-10-16
BlueCat Networks, Inc.Vulnerable2008-09-182008-10-30
Borderware TechnologiesUnknown2008-09-162008-09-16
BroUnknown2008-09-162008-09-16
Charlotte's Web NetworksUnknown2008-09-162008-09-16
Check Point Software TechnologiesUnknown2008-09-162008-09-16
CIACUnknown2008-09-162008-09-16
Cisco Systems, Inc.Not Vulnerable2008-09-162008-11-07
ClavisterUnknown2008-09-162008-09-16
CloudmarkUnknown2008-09-232008-09-23
Computer AssociatesUnknown2008-09-162008-09-16
Computer Associates eTrust Security ManagementUnknown2008-09-162008-09-16
Conectiva Inc.Unknown2008-09-162008-09-16
Cray Inc.Unknown2008-09-162008-09-16
D-Link Systems, Inc.Unknown2008-09-162008-09-16
Data Connection, Ltd.Unknown2008-09-162008-09-16
Debian GNU/LinuxUnknown2008-09-162008-09-16
DragonFly BSD ProjectUnknown2008-09-162008-09-16
Eland SystemsNot Vulnerable2008-09-172008-10-16
EMC CorporationUnknown2008-09-162008-09-16
Engarde Secure LinuxUnknown2008-09-162008-09-16
Enterasys NetworksUnknown2008-09-162008-09-16
EricssonUnknown2008-09-162008-09-16
eSoft, Inc.Unknown2008-09-162008-09-16
Extreme NetworksUnknown2008-09-162008-09-16
F5 Networks, Inc.Unknown2008-09-162008-09-16
Fedora ProjectUnknown2008-09-162008-09-16
Force10 Networks, Inc.Unknown2008-09-162008-09-16
Fortinet, Inc.Unknown2008-09-162008-09-16
Foundry Networks, Inc.Unknown2008-09-162008-09-16
FreeBSD, Inc.Unknown2008-09-162008-09-16
FujitsuUnknown2008-09-162008-09-16
Gentoo LinuxUnknown2008-09-162008-09-16
Global Technology AssociatesUnknown2008-09-162008-09-16
Hewlett-Packard CompanyUnknown2008-09-162008-09-16
HitachiUnknown2008-09-162008-09-16
IBM CorporationUnknown2008-09-162008-09-16
IBM Corporation (zseries)Unknown2008-09-162008-09-16
IBM eServerUnknown2008-09-162008-09-16
Ingrian Networks, Inc.Unknown2008-09-162008-09-16
Intel CorporationUnknown2008-09-162008-09-16
Internet Security Systems, Inc.Unknown2008-09-162008-09-16
IntotoUnknown2008-09-162008-09-16
IP FilterUnknown2008-09-162008-09-16
IP Infusion, Inc.Unknown2008-09-162008-09-16
Juniper Networks, Inc.Unknown2008-09-162008-09-16
Luminous NetworksUnknown2008-09-162008-09-16
m0n0wallUnknown2008-09-162008-09-16
MailFoundryNot Vulnerable2008-09-182008-10-23
Mandriva, Inc.Unknown2008-09-162008-09-16
McAfeeVulnerable2008-09-162008-10-16
Messaging ArchitectsUnknown2008-09-182008-09-18
Microsoft CorporationUnknown2008-09-162008-09-16
Mirapoint, Inc.Unknown2008-09-182008-09-18
MontaVista Software, Inc.Unknown2008-09-162008-09-16
Multitech, Inc.Unknown2008-09-162008-09-16
NEC CorporationUnknown2008-09-162008-09-16
NetAppUnknown2008-09-162008-09-16
NetBSDUnknown2008-09-162008-09-16
netfilterUnknown2008-09-162008-09-16
NokiaUnknown2008-09-162008-09-16
Nortel Networks, Inc.Unknown2008-09-162008-09-16
Novell, Inc.Unknown2008-09-162008-09-16
OpenBSDUnknown2008-09-162008-09-16
Openwall GNU/*/LinuxNot Vulnerable2008-09-162008-10-16
OpenWaveUnknown2008-09-192008-09-19
PePLinkUnknown2008-09-162008-09-16
Process SoftwareVulnerable2008-09-162008-10-16
ProofpointNot Vulnerable2008-09-182008-10-16
Q1 LabsUnknown2008-09-162008-09-16
QNX, Software Systems, Inc.Unknown2008-09-162008-09-16
QuaggaUnknown2008-09-162008-09-16
RadWare, Inc.Unknown2008-09-162008-09-16
Red Hat, Inc.Unknown2008-09-162008-09-16
Redback Networks, Inc.Unknown2008-09-162008-09-16
Roaring Penguin Software Inc.Not Vulnerable2008-09-172008-10-16
SecPointVulnerable2008-09-242008-10-16
Secure Computing Enterprise Security DivisionUnknown2008-09-182008-09-18
Secure Computing Network Security DivisionUnknown2008-09-162008-09-16
SecurenceNot Vulnerable2008-09-192008-10-16
Secureworx, Inc.Unknown2008-09-162008-09-16
Silicon Graphics, Inc.Unknown2008-09-162008-09-16
Slackware Linux Inc.Unknown2008-09-162008-09-16
SmoothWallUnknown2008-09-162008-09-16
SnortUnknown2008-09-162008-09-16
Soapstone NetworksUnknown2008-09-162008-09-16
Sony CorporationUnknown2008-09-162008-09-16
SourcefireUnknown2008-09-162008-09-16
StonesoftUnknown2008-09-162008-09-16
Sun Microsystems, Inc.Not Vulnerable2008-09-162008-10-16
SUSE LinuxNot Vulnerable2008-09-162008-10-16
Symantec, Inc.Not Vulnerable2008-09-162008-10-30
The SCO GroupUnknown2008-09-162008-09-16
TippingPoint, Technologies, Inc.Unknown2008-09-162008-09-16
TurbolinuxUnknown2008-09-162008-09-16
U4EA Technologies, Inc.Unknown2008-09-162008-09-16
UbuntuUnknown2008-09-162008-09-16
UnisysUnknown2008-09-162008-09-16
VyattaUnknown2008-09-162008-09-16
Watchguard Technologies, Inc.Unknown2008-09-162008-09-16
Wind River Systems, Inc.Unknown2008-09-162008-09-16
ZyXELUnknown2008-09-162008-09-16

References

http://www.kb.cert.org/vuls/id/814627
http://www.ietf.org/rfc/rfc4408.txt
http://www.doxpara.com/?page_id=1256
http://www.libspf2.org/docs/html/

Credit

This issue was reported by Dan Kaminsky of Doxpara Research.

This document was written by Chris Taschner.

Other Information

Date Public:2008-10-21
Date First Published:2008-10-30
Date Last Updated:2009-02-17
CERT Advisory: 
CVE-ID(s):CVE-2008-2469
NVD-ID(s):CVE-2008-2469
US-CERT Technical Alerts: 
Metric:9.00
Document Revision:22

Original Source

Url : http://www.kb.cert.org/vuls/id/183657

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20268
 
Oval ID: oval:org.mitre.oval:def:20268
Title: DSA-1659-1 libspf2 - potential remote code execution
Description: Dan Kaminsky discovered that libspf2, an implementation of the Sender Policy Framework (SPF) used by mail servers for mail filtering, handles malformed TXT records incorrectly, leading to a buffer overflow condition (<a href="http://security-tracker.debian.org/tracker/CVE-2008-2469">CVE-2008-2469</a>).
Family: unix Class: patch
Reference(s): DSA-1659-1
CVE-2008-2469
 Version: 5
Platform(s): Debian GNU/Linux 4.0
 Product(s): libspf2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7802
 
Oval ID: oval:org.mitre.oval:def:7802
Title: DSA-1659 libspf2 -- buffer overflow
Description: Dan Kaminsky discovered that libspf2, an implementation of the Sender Policy Framework (SPF) used by mail servers for mail filtering, handles malformed TXT records incorrectly, leading to a buffer overflow condition (CVE-2008-2469). Note that the SPF configuration template in Debian's Exim configuration recommends to use libmail-spf-query-perl, which does not suffer from this issue.
Family: unix Class: patch
Reference(s): DSA-1659
CVE-2008-2469
 Version: 3
Platform(s): Debian GNU/Linux 4.0
 Product(s): libspf2
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 8

OpenVAS Exploits

Date Description
2008-11-01 Name : Debian Security Advisory DSA 1659-1 (libspf2)
File : nvt/deb_1659_1.nasl
2008-11-01 Name : FreeBSD Ports: libspf2
File : nvt/freebsd_libspf2.nasl
2008-11-01 Name : Gentoo Security Advisory GLSA 200810-03 (libspf2)
File : nvt/glsa_200810_03.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
49277 libspf2 Spf_dns_resolv.c SPF_dns_resolv_lookup Function DNS TXT Record Handli...

Snort® IPS/IDS

Date Description
2014-01-10 libspf2 DNS TXT record parsing buffer overflow attempt
RuleID : 15327 - Revision : 8 - Type : PROTOCOL-DNS

Nessus® Vulnerability Scanner

Date Description
2008-10-31 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200810-03.nasl - Type : ACT_GATHER_INFO
2008-10-28 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_2ddbfd29a45511dda55e00163e000016.nasl - Type : ACT_GATHER_INFO
2008-10-27 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1659.nasl - Type : ACT_GATHER_INFO