MaraDNS: Arbitrary code execution

Background

MaraDNS is a proxy DNS server with permanent caching.

Description

A long DNS hostname with a large number of labels could trigger a buffer overflow in the compress_add_dlabel_points() function of dns/Compress.c.

Impact

A remote unauthenticated attacker could execute arbitrary code or cause a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All MaraDNS users should upgrade to the latest stable version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-dns/maradns-1.4.06"

NOTE: This is a legacy GLSA. Updates for all affected architectures are available since February 12, 2011. It is likely that your system is already no longer affected by this issue.