Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitrary code via a long DNS TXT record with a modified length field.

The remote host is affected by the vulnerability described in GLSA-200810-03 (libspf2: DNS response buffer overflow)

    libspf2 uses a fixed-length buffer to receive DNS responses and does     not properly check the length of TXT records, leading to buffer     overflows.
  Impact :

    A remote attacker could store a specially crafted DNS entry and entice     a user or automated system using libspf2 to lookup that SPF entry (e.g.
    by sending an email to the MTA), possibly allowing for the execution of     arbitrary code.
  Workaround :

    There is no known workaround at this time.

CVE reports :

Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitrary code via a long DNS TXT record with a modified length field.

Dan Kaminsky discovered that libspf2, an implementation of the Sender Policy Framework (SPF) used by mail servers for mail filtering, handles malformed TXT records incorrectly, leading to a buffer overflow condition (CVE-2008-2469 ).

Note that the SPF configuration template in Debian's Exim configuration recommends to use libmail-spf-query-perl, which does not suffer from this issue.

ID	Name	Product	Family	Severity
34678	GLSA-200810-03 : libspf2: DNS response buffer overflow	Nessus	Gentoo Local Security Checks	critical
34504	FreeBSD : libspf2 -- Buffer overflow (2ddbfd29-a455-11dd-a55e-00163e000016)	Nessus	FreeBSD Local Security Checks	critical
34492	Debian DSA-1659-1 : libspf2 - buffer overflow	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2008-2469

critical

Tenable Plugins

critical

critical

critical