RE: [cobalt-users] BIND vulnerability

["Brian Collins" <bjcollins@xxxxxxxxxxxxxx>]

If you guys are talking about the critical Bind 8.2.3-Beta > Bind 8.2.3-Rel
then it deals with heap overflows.While this is a buffer overflow, it occurs
in the 'bss' or 'heap' region of process memory. It cannot be exploited in
the same way a stack overflow can be. In addition, this part of memory is
not executable, therefore any shellcode must somehow be put in the stack.

The most likely way to exploit a vulnerability like this is through
corruption of malloc() structures. If an attacker can overwrite the
beginning of a malloc()'ed block of memory and have it remain intact until
free() is called on it, arbitrary locations in memory can be overwritten
with attacker supplied-values.

An attacker may, for example, overwrite a return address on the stack with a
value pointing to shellcode somewhere in executable memory. When the
function returns, the supplied shellcode will be executed with privileges of
named (typically root).