libspf2 contains a buffer overflow vulnerability in code that parses DNS TXT records.
libspf2 is a widely-deployed implementation of the Sender Policy Framework. According to RFC 4408:
An SPF record is a DNS Resource Record (RR) that declares which hosts are, and are not, authorized to use a domain name for the "HELO" and "MAIL FROM" identities. Loosely, the record partitions all hosts into permitted and not-permitted sets (though some hosts might fall into neither category).
This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code on a system running libspf2.
This issue was reported by Dan Kaminsky of Doxpara Research
|Date First Published:||2008-10-30|
|Date Last Updated:||2011-07-22 12:49 UTC|