In our previous article: TCPLogD, TCP logging daemon, we discussed a tool called TCPLogd, which contains a security vulnerability that allows a remote attacker to overflow a buffer, and possibly execute arbitrary code.
Credit:
This vulnerability was reported by: Antonomasia.
The vulnerability exists in the following function:
char *hostlookup(unsigned long int in)
{
static char blah[1024];
struct in_addr i;
struct hostent *he;
Notice that it contains a buffer of 1024 characters that holds the hostname resolved via the gethostbyadd() function. This buffer can be overflowed by creating a PTR DNS record that contain a larger name than 1024 characters.
