3 ms·

Links to commits: https://github.com/NLnetLabs/unbound/commit/09845779d5f2c96e3064ff398cad65c08357cfbf https://github.com/NLnetLabs/unbound/commit/09845779d5f2

by jwilk 7y ago

Links to commits: https://github.com/NLnetLabs/unbound/commit/09845779d5f2c96e3064ff398cad65c08357cfbf https://github.com/NLnetLabs/unbound/commit/09845779d5f2c96e... Shell Injection in IPSECMOD https://github.com/NLnetLabs/unbound/commit/b60c4a472c856f0a98120b7259e991b3a6507eb5 https://github.com/NLnetLabs/unbound/commit/b60c4a472c856f0a... Uninitialized Memory in worker_handle_request() https://github.com/NLnetLabs/unbound/commit/f887552763477a606a9608b0f6b498685e0f6587 https://github.com/NLnetLabs/unbound/commit/f887552763477a60... Config Injection in create_unbound_ad_servers.sh https://github.com/NLnetLabs/unbound/commit/226298bbd36f1f0fd9608e98c2ae85988b7bbdb8 https://github.com/NLnetLabs/unbound/commit/226298bbd36f1f0f... Integer Overflow in Regional Allocator https://github.com/NLnetLabs/unbound/commit/a3545867fcdec50307c776ce0af28d07046a52dd https://github.com/NLnetLabs/unbound/commit/a3545867fcdec503... Integer Overflow in sldns_str2wire_dname_buf_origin() https://github.com/NLnetLabs/unbound/commit/fa23ee8f31ba9a018c720ea822faaee639dc7a9c https://github.com/NLnetLabs/unbound/commit/fa23ee8f31ba9a01... Out of Bounds Write in sldns_bget_token_par() https://github.com/NLnetLabs/unbound/commit/f5e06689d193619c57c33270c83f5e40781a261d https://github.com/NLnetLabs/unbound/commit/f5e06689d193619c... Assert Causing DoS in synth_cname() https://github.com/NLnetLabs/unbound/commit/d2eb78e871153f22332d30c6647f3815148f21e5 https://github.com/NLnetLabs/unbound/commit/d2eb78e871153f22... Assert Causing DoS in dname_pkt_copy() https://github.com/NLnetLabs/unbound/commit/02080f6b180232f43b77f403d0c038e9360a460f https://github.com/NLnetLabs/unbound/commit/02080f6b180232f4... Integer Overflows in Size Calculations https://github.com/NLnetLabs/unbound/commit/2d444a5037acff6024630b88092d9188f2f5d8fe https://github.com/NLnetLabs/unbound/commit/2d444a5037acff60... Insufficient Handling of Compressed Names in dname_pkt_copy() https://github.com/NLnetLabs/unbound/commit/6c3a0b54ed8ace93d5b5ca7b8078dc87e75cd640 https://github.com/NLnetLabs/unbound/commit/6c3a0b54ed8ace93... Out of Bound Write Compressed Names in rdata_copy()

tinus_hn 7y ago
The first one is truly terrible, everyone who commits to a project like this should understand that passing network data to a shell is a recipe for disaster. The proper fix is not to validate the arguments, the proper fix is not to use the shell at all. Luckily this appears to be an optional plugin. Party like it’s 1975 indeed.
- watermelon0 7y ago
  Using execve() and friends should be preferred, unless you have a really good reason for spawning a shell.

by jwilk 7y ago

tinus_hn 7y ago

The first one is truly terrible, everyone who commits to a project like this should understand that passing network data to a shell is a recipe for disaster. The proper fix is not to validate the arguments, the proper fix is not to use the shell at all. Luckily this appears to be an optional plugin. Party like it’s 1975 indeed.

watermelon0 7y ago
Using execve() and friends should be preferred, unless you have a really good reason for spawning a shell.