oss-security - Re: CVE id request: tinydns crafted zone file cache poisoning vulnerability

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Mon, 16 Mar 2009 21:04:52 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE id request: tinydns crafted zone file cache
 poisoning vulnerability


======================================================
Name: CVE-2009-0858
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0858
Reference: BUGTRAQ:20090226 djbdns misformats some long response packets; patch and example attack
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/501294/100/0/threaded
Reference: BUGTRAQ:20090228 Re: djbdns misformats some long response packets; patch and example attack
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/501340/100/0/threaded
Reference: BUGTRAQ:20090305 Re: djbdns misformats some long response packets; patch and example attack
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/501479/100/0/threaded
Reference: MLIST:[dns] 20090225 djbdns misformats some long response packets; patch and example
Reference: URL:http://marc.info/?l=djbdns&m=123554945710038
Reference: MLIST:[dns] 20090304 djbdns<=1.05 lets AXFRed subdomains overwrite domains
Reference: URL:http://marc.info/?l=djbdns&m=123613000920446&w=2
Reference: MISC:http://it.slashdot.org/article.pl?sid=09/03/05/2014249
Reference: MISC:http://securityandthe.net/2009/03/05/security-issue-in-djbdns-confirmed/
Reference: BID:33937
Reference: URL:http://www.securityfocus.com/bid/33937
Reference: XF:djbdns-response-packet-spoofing(49003)
Reference: URL:http://xforce.iss.net/xforce/xfdb/49003

The response_addname function in response.c in Daniel J. Bernstein
djbdns 1.05 and earlier does not constrain offsets in the required
manner, which allows remote attackers, with control over a third-party
subdomain served by tinydns and axfrdns, to trigger DNS responses
containing arbitrary records via crafted zone data for this subdomain.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.