From 4263f395efd136dece52d765dfcff3c96f17506e Mon Sep 17 00:00:00 2001 From: Phil Pennock Date: Wed, 24 Oct 2012 23:26:29 -0400 Subject: [PATCH 1/3] SECURITY: DKIM DNS buffer overflow protection CVE-2012-5671 malloc/heap overflow, with a 60kB window of overwrite. Requires DNS under control of person sending email, leaves plenty of evidence, but is very likely exploitable on OSes that have not been well hardened. --- doc/doc-txt/ChangeLog | 8 ++++++++ src/src/dkim.c | 3 +++ src/src/pdkim/pdkim.h | 4 ++-- 3 files changed, 13 insertions(+), 2 deletions(-) Index: exim4-4.76/src/dkim.c =================================================================== --- exim4-4.76.orig/src/dkim.c 2011-05-09 04:36:25.000000000 -0400 +++ exim4-4.76/src/dkim.c 2012-10-25 08:26:24.009726695 -0400 @@ -44,6 +44,9 @@ "%.*s", (int)len, (char *)((rr->data)+rr_offset)); rr_offset+=len; answer_offset+=len; + if (answer_offset >= PDKIM_DNS_TXT_MAX_RECLEN) { + return PDKIM_FAIL; + } } } else return PDKIM_FAIL; Index: exim4-4.76/src/pdkim/pdkim.h =================================================================== --- exim4-4.76.orig/src/pdkim/pdkim.h 2011-05-09 04:36:25.000000000 -0400 +++ exim4-4.76/src/pdkim/pdkim.h 2012-10-25 08:26:24.009726695 -0400 @@ -29,8 +29,8 @@ /* -------------------------------------------------------------------------- */ /* Length of the preallocated buffer for the "answer" from the dns/txt - callback function. */ -#define PDKIM_DNS_TXT_MAX_RECLEN 4096 + callback function. This should match the maximum RDLENGTH from DNS. */ +#define PDKIM_DNS_TXT_MAX_RECLEN (1 << 16) /* -------------------------------------------------------------------------- */ /* Function success / error codes */