The compress_add_dlabel_points function in dns/Compress.c in MaraDNS 1.4.03, 1.4.05, and probably other versions allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long DNS hostname with a large number of labels, which triggers a heap-based buffer overflow.

According to its self-reported version number, the MaraDNS server running on the remote host is affected by a heap-based buffer overflow due to improperly sanitizing user-supplied input submitted to the compress_add_dlabel_points' function in the 'Compress.c' source file.
This issue could allow a remote attacker to crash the DNS server, resulting in a denial of service or possibly code execution.

The remote host is affected by the vulnerability described in GLSA-201111-06 (MaraDNS: Arbitrary code execution)

    A long DNS hostname with a large number of labels could trigger a buffer       overflow in the compress_add_dlabel_points() function of dns/Compress.c.
  Impact :

    A remote unauthenticated attacker could execute arbitrary code or cause       a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Witold Baryluk discovered that MaraDNS, a simple security-focused Domain Name System server, may overflow an internal buffer when handling requests with a large number of labels, causing a server crash and the consequent denial of service.

MaraDNS developer Sam Trenholme reports :

... a mistake in allocating an array of integers, allocating it in bytes instead of sizeof(int) units. This resulted in a buffer being too small, allowing it to be overwritten. The impact of this programming error is that MaraDNS can be crashed by sending MaraDNS a single 'packet of death'. Since the data placed in the overwritten array cannot be remotely controlled (it is a list of increasing integers), there is no way to increase privileges exploiting this bug.

ID	Name	Product	Family	Severity
73481	MaraDNS < 1.3.07.11 / 1.4.x < 1.4.06 / 2.0.x < 2.0.02 compress_add_dlabel_points Function Buffer Overflow	Nessus	DNS	high
56902	GLSA-201111-06 : MaraDNS: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
52720	Debian DSA-2196-1 : maradns - buffer overflow	Nessus	Debian Local Security Checks	high
51832	FreeBSD : maradns -- denial of service when resolving a long DNS hostname (8015600f-2c80-11e0-9cc1-00163e5bf4f9)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2011-0520

critical

Tenable Plugins

high

high

high

high