The host_aton() buffer overflow: (1) Put a check in host_aton() itself;

(2) noted that the exploit via dnsdb/ptr lookup was already fortuitously
fixed by a previous change.

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 3492968172686b60ec7caa562400aaf7d8b69ed7..eff7a9d7e3ae903547fada5e71c7df4ca1d6d6ee 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -1,4 +1,4 @@
-$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.57 2004/12/22 12:05:45 ph10 Exp $
+$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.58 2004/12/29 10:16:52 ph10 Exp $
 
 Change log file for Exim from version 4.21
 -------------------------------------------
@@ -236,8 +236,8 @@ Exim version 4.50
 
 55. Some experimental protocols are using DNS PTR records for new purposes. The
     keys for these records are domain names, not reversed IP addresses. The
-    dnsdb lookup now tests whether it's key is an IP address. If not, it leaves
-    it alone. Component reversal etc. now happens only for IP addresses.
+    dnsdb PTR lookup now tests whether its key is an IP address. If not, it
+    leaves it alone. Component reversal etc. now happens only for IP addresses.
 
 56. Improve error message when ldap_search() fails in OpenLDAP or Solaris LDAP.
 
@@ -253,6 +253,14 @@ Exim version 4.50
       (2) The default for smtp_banner uses $smtp_active_hostname instead
           of $primary_hostname.
 
+60. The host_aton() function is supposed to be passed a string that is known
+    to be a valid IP address. However, in the case of IPv6 addresses, it was
+    not checking this. This is a hostage to fortune. Exim now panics and dies
+    if the condition is not met. A case was found where this could be provoked
+    from a dnsdb lookup; fortuitously, this particular loophole had already
+    been fixed by change 4.50/55 above. If there are any other similar
+    loopholes, the new check should stop them being exploited.
+
 
 Exim version 4.43
 -----------------

diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index bf9890bb31403504db28f584ba6f6bc0756d9d73..30cb58ab512e98edfa11bb6749aea6b05682a0a5 100644 (file)
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -1,4 +1,4 @@
-$Cambridge: exim/doc/doc-txt/NewStuff,v 1.23 2004/12/22 12:05:45 ph10 Exp $
+$Cambridge: exim/doc/doc-txt/NewStuff,v 1.24 2004/12/29 10:16:52 ph10 Exp $
 
 New Features in Exim
 --------------------
@@ -234,9 +234,9 @@ Version 4.50
 19. The Exiscan patch is now merged into the main source. See src/EDITME for
     parameters for the build.
 
-20. If the key for a dnsdb lookup is not an IP address, it is used verbatim,
-    without component reversal and without the addition of in-addr.arpa or
-    ip6.arpa.
+20. If the key for a dnsdb PTR lookup is not an IP address, it is used
+    verbatim, without component reversal and without the addition of
+    in-addr.arpa or ip6.arpa.
 
 21. Two changes related to the smtp_active_hostname option:
 

diff --git a/src/src/host.c b/src/src/host.c
index fb58ab4da32d14b466ab76dbf18c58c2bc7d1f31..46c57683af3a7472700b6ffbbfcf0321e21bc8f6 100644 (file)
--- a/src/src/host.c
+++ b/src/src/host.c
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/host.c,v 1.3 2004/11/18 11:17:33 ph10 Exp $ */
+/* $Cambridge: exim/src/src/host.c,v 1.4 2004/12/29 10:16:53 ph10 Exp $ */
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
@@ -754,12 +754,18 @@ if (Ustrchr(address, ':') != NULL)
 
   if (*p == ':') p++;
 
-  /* Split the address into components separated by colons. */
+  /* Split the address into components separated by colons. The input address 
+  is supposed to be checked for syntax. There was a case where this was 
+  overlooked; to guard against that happening again, check here and crash if 
+  there is a violation. */
 
   while (*p != 0)
     {
     int len = Ustrcspn(p, ":");
     if (len == 0) nulloffset = ci;
+    if (ci > 7) log_write(0, LOG_MAIN|LOG_PANIC_DIE, 
+      "Internal error: invalid IPv6 address \"%s\" passed to host_aton()",
+      address);  
     component[ci++] = p;
     p += len;
     if (*p == ':') p++;