Hi

Thanks for reviving this thread

The security flaw[1] is a classical integer overflow, which leads
to an heap overflow[2]: if strlen(server) is 254 or 255 the resulting
namelen is 0 or 1 respectively.

I tried to identify conditions which turn the security flaw into a
vulnerability. I have not found such a combination (hence I was
not able to write an exploit). But then, my knowledge is limited,
hence the question still stays open: any other ways to proceed?


Thanks & Cheers



[1] http://www.sei.cmu.edu/pub/documents...df/05tn003.pdf , Section 1.1
[2] http://www.securityfocus.com/infocus/1846, nice review and outlook