| タイトル | The Trusted Domain Project OpenDMARC 1.4.2 Integer Overflow |
|---|
| 説明 | OpenDMARC 1.4.2 contains an integer wraparound vulnerability when parsing the DMARC `pct` tag. The value is converted to a 32-bit unsigned integer before OpenDMARC verifies that it falls within the RFC-defined range of 0 to 100. Consequently, an out-of-range value is reduced modulo 2³² before validation.
For example, `pct=4294967296` wraps to `0`, while `pct=4294967346` wraps to `50`. OpenDMARC accepts these records and applies the resulting wrapped value as the policy sampling percentage, even though the published values are invalid under RFC 7489. The enforced DMARC policy can therefore differ from the policy actually published by the domain owner.
An attacker able to influence a domain’s DMARC record can exploit the issue by supplying a specially chosen `pct` value. The same behavior may also be triggered by an administrative configuration error. Depending on the wrapped result, OpenDMARC may enforce the policy at an unintended sampling rate or treat the record as invalid and fail to apply a published `p=reject` or `p=quarantine` policy.
The issue is caused by integer overflow during conversion and should be addressed by detecting overflow and validating the original numeric value before storing it in a 32-bit type. |
|---|
| ソース | ⚠️ https://xuyongzhe-vt.github.io/share/dmarc-pct-integer-handling.html |
|---|
| ユーザー | yongzhe_xu (UID 100420) |
|---|
| 送信 | 2026年08月07日 06:09 (2 月 ago) |
|---|
| モデレーション | 2026年09月28日 13:53 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 411036 [Trusted Domain Project OpenDMARC 迄 1.4.2 DMARC Parser opendmarc_policy.c pct メモリ破損] |
|---|
| ポイント | 20 |
|---|