[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87boaz3qk9.fsf@windlord.stanford.edu>
Date: Mon, 04 Mar 2013 11:36:38 -0800
From: Russ Allbery <rra@...nford.edu>
To: oss-security@...ts.openwall.com
Subject: Re: Reverse lookup issue in Net::Server
Remi Gacogne <rgacogne-bugs@...edump.fr> writes:
> I think there is a security issue in the way the access control feature
> of Net::Server (http://search.cpan.org/perldoc?Net%3A%3AServer) works.
> Net::Server is used by various projects including Munin, Postgrey and
> SQLgrey.
> The issue lies in the fact that the allow / deny access control does not
> perform a valid DNS check when given a hostname parameter and the
> 'reverse_lookups' option is enabled. The current code only checks that
> the incoming connection source IP address has a reverse DNS matching the
> given hostname, but does not check that the hostname resolves back to
> this source IP address (see how the $prop->{'peerhost'} property is set
> in get_client_info(), lib/Net/Server.pm:553, then used in allow_deny(),
> lib/Net/Server.pm:597). As it is trivial for an attacker to be able to
> set his own source IP's reverse DNS, the current check is not safe (this
> probably matches CWE-807: Reliance on Untrusted Inputs in a Security
> Decision).
This is a very weak security measure, but yes, the need to check the
reverse DNS results with a forward DNS query to make the security check at
all useful has been well-known going all the way back to the days when TCP
wrappers was the UNIX firewalling system of choice. I remember discussion
of this in security contexts in 1994, and I'm sure it was an old
discussion even then.
--
Russ Allbery (rra@...nford.edu) <http://www.eyrie.org/~eagle/>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
