Bug/Vulnerability in `Dig' in latest dnsutils/bind9

2014-10-28 Thread Joshua Rogers
Hi everybody, Awhile back I found a bug in Dig with the combination of the '+nssearch' and '+tcp' flag. (https://bugs.launchpad.net/ubuntu/+source/bind9/+bug/1258003) It has since been patched. I've come across another bug/vulnerability. From what I can tell, it's a null pointer bug. Using the

Re: Bug/Vulnerability in `Dig' in latest dnsutils/bind9

2014-10-28 Thread Mukund Sivaraman
Hi Joshua On Tue, Oct 28, 2014 at 07:30:45PM +1100, Joshua Rogers wrote: Using the +nssearch and +tcp flags together, when looking at a domain with an ipv6 address, Dig crashes with a segmentation fault. Thank you for this bug report. I've forwarded it to our bug tracker. If you want to

Re: Bug/Vulnerability in `Dig' in latest dnsutils/bind9

2014-10-28 Thread Joshua Rogers
Thanks. Also, this may be relevant: Fails an assertion on NetBSD, maybe this provides further insight: $ uname -a NetBSD alix.localdomain 6.1_STABLE NetBSD 6.1_STABLE (ALIXKERN) #0: Sat Oct 11 16:21:44 CEST 2014 fisted@alix.localdomain:/usr/src/sys/arch/i386/compile/ALIXKERN i386 $ dig -v

Re: Bug/Vulnerability in `Dig' in latest dnsutils/bind9

2014-10-28 Thread Mukund Sivaraman
Hi Joshua On Tue, Oct 28, 2014 at 07:30:45PM +1100, Joshua Rogers wrote: I'm not sure if this is really severe enough for a CVE-ID or not, but let me know about it anyways. This crashes out almost immediately after next is assigned -1, by dereferencing *(-1) which is likely not mapped on any