Last updated 24 July 2024
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages. CVE-2021-20314 has been assigned to this issue.
References: https://seclists.org/oss-sec/2021/q3/94 https://github.com/shevek/libspf2/commit/c37b7c13c30e225183899364b9f2efdfa85552ef
Description Attack type
Remote
Impact
(x) Code Execution (x) Denial of Service
Attack vector(s): Patch
The issue has been fixed in github commit c37b7c1:
https://github.com/shevek/libspf2/commit/c37b7c13c30e225183899364b9f2efdfa85552ef Discoverer(s)/Credits
Philipp Jeitner and Haya Shulman, Fraunhofer SIT
philipp.jeitner () sit fraunhofer de haya.shulman () sit fraunhofer de
Reference(s)
- libspf2: https://www.libspf2.org/, https://github.com/shevek/libspf2 Details and information to reproduce the vulnerability
To reproduce, set the SPF record of a domain you control like listed below:
example.com. 300 IN TXT "v=spf1 exp=exp.example.com"
spfquery --sender someone () example com -ip 1.2.3.4 stack smashing detected : terminated Aborted (core dumped)
Heap-based buffer overflow in the SPFdnsresolvlookup function in Spfdnsresolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitrary code via a long DNS TXT record with a modified length field.