Windows XP SP1 gethostbyaddr() flow (Re[3]: mirc32 6.0x crash when resolving dns.)

Dear vulndev,

It's definitely bug in Windows XP SP1, as it was supposed by Roland Postle <mail@blazde.co.uk> To reproduce it:

1. Created zone 1.168.192.in-addr.arpa and add record:

254 IN CNAME non.existant.name

2. Use test program attached

3. I did tests on Windows NT 4.0, Windows 2000 and Windows XP SP1. Results:

Windows NT 4.0:

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

c:\>test.exe 192.168.1.254
gethostbyaddr failed

Windows 2000:

C:\>test.exe 192.168.1.254
gethostbyaddr failed

Windows XP SP1:

C:\>test.exe 192.168.1.254
h_name: (null)

So, this problem is not specific to mIRC and it's possible to crash any application on Windows XP Sp1 where gethostbyaddr() or WSAAsyncGetHostByAddr() is used for reverse name resolution (IRC clients, Peer-to-Peer clients, personal firewalls, etc).

Can somebody test Windows 2003?

--Thursday, May 29, 2003, 11:52:59 AM, you wrote to roam@ringlet.net:

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

3> Dear Peter Pentchev,

3> A way to delegate reverse resolution for network less than /24 is 3> defined in RFC 2317. And it's different from one used.

3> But  you're  right: the problem is probably not in unresolvable PTR. The
3> problem  is  in unresolvable CNAME instead of PTR, so PTR is never found
3> at   all.   And   yes:   it  may  affect  different  applications  where
3> gethostbyname()  is  used. I will test gethostbyname() behavior for this
3> case in Windows and Unix and report back.

3> --Thursday, May 29, 2003, 11:26:04 AM, you wrote to 3APA3A@SECURITY.NNOV.RU:

PP>> On Wed, May 28, 2003 at 02:45:25PM +0400, 3APA3A wrote:

PP>> This is not necessarily a flawed record; I believe it might be as simple
PP>> as the ultimate in classless reverse DNS delegation.  Note that the
PP>> 16.193.210.in-addr.arpa zone is delegated to ns[12].qala.com.sg, while
PP>> this specific "alias" subdelegates the reverse DNS records for
PP>> 210.193.16.25 to dns[12].lga.net.sg.

PP>> G'luck,
PP>> Peter

-- 
~/ZARAZA
Ìàøèíà îêàçàëàñü ñïîñîáíîé ê åäèíñòâåííîìó äåéñòâèþ,
à èìåííî óìíîæåíèþ 2x2, äà è òî ïðè ýòîì îøèáàÿñü. (Ëåì)