[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <55E8995A.9040901@redhat.com>
Date: Thu, 3 Sep 2015 21:02:50 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Cc: ISC Security Officer <security-officer@....org>
Subject: Re: Two new vulnerabilities in BIND: CVE-2015-5722 and
CVE-2015-5986 are now public
On 09/02/2015 10:52 PM, ISC Security Officer wrote:
> Please be advised that ISC publicly announced two critical
> vulnerabilities in BIND:
>
> + CVE-2015-5722 is a denial-of-service vector which can be
> exploited remotely against a BIND server that is performing
> validation on DNSSEC-signed records. All versions of BIND since
> 9.0.0 are vulnerable.
> https://kb.isc.org/article/AA-01287
Your patch had quite good obfuscation, and it took me a while to see
where the actual fix was. Was this deliberate?
But anyway, we can confirm it's exploitable over the network. Nice
analysis, I would not have immediately seen that if I only had Hanno's
reproducer.
For validating recursors, it's actually quite a bit worse than
CVE-2015-5477 because CVE-2015-5722 does not require a completely
crafted query, just an attacker-controlled QNAME (which can be in the
in-addr.arpa or ip6.arpa tree) is sufficient. So attacks could be
reflected through basically anything.
> + CVE-2015-5986 is a denial-of-service vector which can be used
> against a BIND server that is performing recursion and (under
> limited conditions) an authoritative-only nameserver.
> Versions of BIND since 9.9.7 and 9.10.2 are vulnerable.
> https://kb.isc.org/article/AA-01291
This can't be reflected as easily, only through applications that use
the affected record type.
--
Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
