FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

glibc -- getaddrinfo stack-based buffer overflow

Affected packages
linux_base-c6 < 6.7_1
linux_base-c6_64 < 6.7_1
0 <= linux_base-f10

Details

VuXML ID 2dd7e97e-d5e8-11e5-bcbd-bc5ff45d0f28
Discovery 2016-02-16
Entry 2016-02-18

Fabio Olive Leite reports:

A stack-based buffer overflow was found in libresolv when invoked from nss_dns, allowing specially crafted DNS responses to seize control of EIP in the DNS client. The buffer overflow occurs in the functions send_dg (send datagram) and send_vc (send TCP) for the NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC family, or in some cases AF_INET6 family. The use of AF_UNSPEC (or AF_INET6 in some cases) triggers the low-level resolver code to send out two parallel queries for A and AAAA. A mismanagement of the buffers used for those queries could result in the response of a query writing beyond the alloca allocated buffer created by __res_nquery.

References

CVE Name CVE-2015-7547
FreeBSD PR ports/207272
URL https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/
URL https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547
URL https://googleonlinesecurity.blogspot.no/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
URL https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html