Posadis DNS Server NULL Pointer Dereference Vulnerability and Patch

Affected Products Posadis DNS Server: All platforms, versions 0.50.4 through 0.50.8 Unaffected Posadis DNS Server, Milestone 5 and earlier; versions 0.50.9 and later, or version 0.50.8 with the applied bugfix patch Poslib DNS library and its applications, such as Simple Authoritative Name Server and Pos6, 0.60.x series of Posadis Details Posadis versions 0.50.4 through 0.50.8 contain a flaw where these versions fail to properly check whether specific DNS information includes a query section. As a result, the server may attempt to read from a NULL memory location. This issue was discovered during internal testing, and any user can trigger a DNS server crash by sending malformed packets. Since operating systems typically prevent applications from reading from NULL, this vulnerability will always cause Posadis to crash. Although we believe it is not possible to exploit this issue to gain control of your machine, the security risk should still be taken seriously. Solution Users of Posadis 0.50.8 and earlier versions should upgrade as soon as possible to version 0.50.9 or later, or use the following resources (available at www.posadis.org/files/): Download new source package: ( ) Download Posadis 0.50.8 source patch: ( ) Download Linux binary: ( ) Download Windows binary: ( ) This patch includes cumulative fixes for recently discovered FreeBSD build issues and some minor standard compatibility fixes. SecurityFocus Article Related SecurityFocus article is available at: http://www.securityfocus.com/bid/6799

Goal Reached Thanks to every supporter — we hit 100%!

Posadis DNS Server NULL Pointer Dereference Vulnerability and Patch