A tale of a DNS exploit: CVE-2015-7547

What this post added

This post details the analysis and exploitation of CVE-2015-7547, a buffer overflow vulnerability in the GNU libc DNS stub resolver. It demonstrates multiple attack vectors, including on-path and off-path scenarios, and evaluates the effectiveness of proposed mitigations like limiting UDP response sizes. The post highlights the challenges of cache traversal attacks against resolvers like dnsmasq and dnscache, and emphasizes the critical need for patching systems to address this vulnerability.