Multiple security problems in Posadis 0.50.x
============================================

This document attempts to describe some miscellaneous security problems in
the Posadis 0.50.x series that have not already been described in another
advisory.

Memory leaks
------------

Posadis versions prior to m5pre1 contained two memory leaks, thus making
Posadis consume too much of your precious resources, and making it vulnerable
to a denial-of-service attack.

SIGFPE handling
---------------

Posadis versions prior to m5pre1 did not gracefully handle the SIGFPE signal,
thus causing the server not to gracefully close TCP connections.

Secondary zone bug
------------------

Posadis versions prior to 0.50.4 contained an error in the secondary zone
configuration, causing Posadis to crash after a while. This error could be
remotely exploited by master servers for the secondary zone.

One-byte buffer overflow
------------------------

Posadis 0.50.5 and before had an error in the dns message reading function
that caused a one-byte buffer overflow. This might have been remotely
exploitable.