oss-security - CVE Request New-djbdns: dnscache: potential cache poisoning

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LFD.2.10.1402101256050.2145@wniryva.cad.erqung.pbz>
Date: Mon, 10 Feb 2014 13:04:48 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: oss security list <oss-security@...ts.openwall.com>
Subject: CVE Request New-djbdns: dnscache: potential cache poisoning

   Hello,

Please see -> https://00f.net/2012/06/26/dnscache-poisoning-and-siphash/

===
...
By exploiting a hash table collision, an attacker has no way to trigger a DoS, 
but he can actually do something way more interesting: force the resolver to 
send the same query for the same TLD, over and over again, always to the same 
set of servers, no matter what the intended TTL is and no matter what the 
cache size is.

And suddenly, poisoning dnscache with a malicious TLD much, much, much easier 
and faster.
===

Not sure if it qualifies for a CVE; the excerpt above deems it a likely 
candidate.

Upstream fix:
-------------
   -> https://github.com/pjps/ndjbdns/commit/16cb625eccbd68045737729792f09b4945a4b508

Thank you.
--
Prasad J Pandit / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.