T-021: libspf2 DNS TXT Vulnerability

Tags

dns, security, txt

Special Forums Cybersecurity Security Advisories (RSS) T-021: libspf2 DNS TXT Vulnerability

11-13-2008

Registered User

26,240, 27

Join Date: Sep 2000

Last Activity: 1 August 2008, 3:09 PM EDT

Posts: 26,240

Thanks Given: 0

Thanked 27 Times in 26 Posts

T-021: libspf2 DNS TXT Vulnerability

libspf2 contains a buffer overflow vulnerability in code that parses DNS TXT records. An SPF record is a DNS Resource Record (RR) that declares which hosts are, and are not, authorized to use a domain name for the "HELO" and "MAIL FROM" identities. The risk is MEDIUM. This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code on a system running libspf2.

More...

Linux Bot

View Public Profile for Linux Bot

Find all posts by Linux Bot

Previous Thread | Next Thread

1 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

In BIND 9.3 DNS trying to get past the 256 char limit in SPF TXT records

One way I was told to do was incase strings in quotes. But I was given this option if I can get it to work. Will this work for splitting up SPF records? I am try to make bx.example.com reference spf.eu.***, spfa.eu.***, spfb.eu.***, and spfc.eu.***. spf.eu.example.com 3600 IN TXT "v=spf1...

LEARN ABOUT PHP

checkdnsrr

CHECKDNSRR(3)								 1							     CHECKDNSRR(3)

checkdnsrr - Check DNS records corresponding to a given Internet host name or IP address

SYNOPSIS

       bool checkdnsrr (string	$host, [string	$type = "MX"])

DESCRIPTION

	Searches DNS for records of type $type corresponding to $host.

PARAMETERS

	      o $host
		-$host may either be the IP address in dotted-quad notation or the host name.

	      o $type
		-$type may be any one of: A, MX, NS, SOA, PTR, CNAME, AAAA, A6, SRV, NAPTR, TXT or ANY.

RETURN VALUES

	Returns TRUE if any records are found; returns FALSE if no records were found or if an error occurred.

CHANGELOG

       +--------+---------------------------------------------------+
       |Version |						    |
       |	|						    |
       |	|		     Description		    |
       |	|						    |
       +--------+---------------------------------------------------+
       | 5.3.0	|						    |
       |	|						    |
       |	|  This  function is now available on Windows plat- |
       |	| forms.					    |
       |	|						    |
       | 5.2.4	|						    |
       |	|						    |
       |	|		 TXT $type was added.		    |
       |	|						    |
       +--------+---------------------------------------------------+
NOTES

       Note

	       For compatibility with Windows before this was implemented, then try the PEAR class Net_DNS.

SEE ALSO

       dns_get_record(3), getmxrr(3), gethostbyaddr(3), gethostbyname(3), gethostbynamel(3), the named(8) manual page.

PHP Documentation Group 													     CHECKDNSRR(3)

Security Advisories (RSS)