DNS-Linked Flaw Leaves Many Systems Vulnerable

Researchers at Google disclosed a stack-based buffer overflow in the glibc DNS client resolver (CVE-2015-7547) that can be triggered by specially crafted, overly long DNS responses and may allow remote code execution on systems using glibc >= 2.9. Google developed a proof-of-concept exploit (not publicly released), recommended mitigations (drop large UDP DNS packets, use local resolvers, limit TCP response sizes, use DNSMasq), and warned the flaw's wide reach makes it potentially very impactful.