[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170630105705.GA4208@openwall.com>
Date: Fri, 30 Jun 2017 12:57:05 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: ISC Security Officer <security-officer@....org>
Subject: Re: ISC announces two BIND vulnerabilities
For transparency and for information of those wanting to join the
distros list (thus, for them to have a better idea of whether
membership would be useful to them or not): ISC brought these issues to
the distros list on June 28 (or the night of June 29 UTC), so distros
list members had about 1.5 days of advance notice.
On Fri, Jun 30, 2017 at 12:41:33PM +0200, Yves-Alexis Perez wrote:
> As per list policy, and since I'm following these for Debian, here's some more
> details inline for the list.
Thank you, Yves-Alexis!
Adding to this, attached are text exports of the ISC advisories,
produced by running ELinks against "Print Article" versions of the ISC
web pages.
It would be great if ISC would resume posting the actual detail in here
themselves, in addition to the website links.
> The vulnerabilities are very similar to the knot one (no CVE yet) found by the
> same researchers (Synaktiv):
>
> CVE-2017-3142: An error in TSIG authentication can permit unauthorized zone
> transfers
>
> An attacker who is able to send and receive messages to an authoritative DNS
> server and who has knowledge of a valid TSIG key name may be able to
> circumvent TSIG authentication of AXFR requests via a carefully constructed
> request packet. A server that relies solely on TSIG keys for protection with
> no other ACL protection could be manipulated into:
>
> * providing an AXFR of a zone to an unauthorized recipient
> * accepting bogus NOTIFY packets
>
> CVE-2017-3043: An error in TSIG authentication can permit unauthorized dynamic
> updates
>
> An attacker who is able to send and receive messages to an authoritative DNS
> server and who has knowledge of a valid TSIG key name for the zone and service
> being targeted may be able to manipulate BIND into accepting an unauthorized
> dynamic update.
Thanks again,
Alexander
View attachment "CVE-2017-3142.txt" of type "text/plain" (6478 bytes)
View attachment "CVE-2017-3143.txt" of type "text/plain" (5981 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
