Heap-based buffer overflow in libspf2 - CVE-2021-33912

Vulnerability identifier: #VU85406

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-33912

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the SPF_record_expand_data() function in spf_expand.c. A remote attacker with control over a DNS server can create a specially crafted SPF DNS record, force the library to read data from the malicious DNS server, trigger a four-byte heap-based buffer overflow and execute arbitrary code on the system.

libspf2
Gentoo Linux
Ubuntu
libmail-spf-xs-perl (Ubuntu package)
libspf2-2 (Ubuntu package)
libspf2-dev (Ubuntu package)
spfquery (Ubuntu package)
mail-filter/libspf2

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

libmail-spf-xs-perl (Ubuntu package) - addressed in versions Ubuntu Pro, 1.2.10-7+deb9u2build0.20.04.1
libspf2-2 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.2.10-7+deb9u2build0.20.04.1
libspf2-dev (Ubuntu package) - addressed in versions Ubuntu Pro, 1.2.10-7+deb9u2build0.20.04.1
spfquery (Ubuntu package) - addressed in versions Ubuntu Pro, 1.2.10-7+deb9u2build0.20.04.1
mail-filter/libspf2 - update to 1.2.11

• https://github.com/shevek/libspf2/tree/8131fe140704eaae695e76b5cd09e39bd1dd220b
• https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosure
• https://lists.debian.org/debian-lts-announce/2022/01/msg00015.html

• Remote code execution in libspf2
• Gentoo update for libspf2
• Ubuntu update for libspf2
• Ubuntu update for libspf2