OpenDMARC vulnerabilities

A vulnerability in OpenDMARC up to 1.4.2 affects the strcasecmp function in libopendmarc/opendmarc_policy.c, leading to improper handling of exceptional conditions. The attack can be executed remotely, and the exploit has been made public.

A vulnerability in OpenDMARC up to 1.4.2 affects the opendmarc_policy_parse_dmarc function in libopendmarc/opendmarc_policy.c. Manipulation of arguments like fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to improper handling of exceptional conditions. Remote exploitation is possible, and the exploit has been disclosed.

A flaw was found in Trusted Domain Project OpenDMARC up to 1.4.2 in unknown functionality of policy.c in the Domain Handler component. Manipulation leads to improper validation of unsafe equivalence, and the attack can be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2 in the function opendmarc_util_cleanup in libopendmarc/opendmarc_util.c of the DMARC Record Parser component. Manipulation results in an off-by-one, and the attack may be initiated remotely. The exploit is public and the patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae.

Vulnerability in Trusted Domain Project OpenDMARC up to version 1.4.2 in the opendmarc_policy_query_dmarc function in libopendmarc/opendmarc_policy.c of the Internationalized Domain Name Handler component. Manipulation leads to encoding error. Remote attack possible, exploit publicly disclosed.

A null pointer dereference vulnerability was found in OpenDMARC up to 1.4.2 in the opendmarc_spf_ipv6_explode function. Manipulating the cp argument causes the issue. The attack can be initiated remotely and the exploit is published.