Re: debian bug report on bind9 DoS

[Robert Buchholz <rbu () gentoo org>]

On Tuesday 28 July 2009, Vincent Danen wrote:
> I don't think
> it's a huge problem with a well-secured bind9 configuration, but
> could be quite problematic for bind config's that allow updates
> without an RNDC key (typical of some dynamic DNS implementations), or
> on a system that has lax enough permissions that the RNDC key is
> exposed.

The crash is not limited to configurations that allow updates.
The ISC advisory states so as well, and I could reproduce the DoS on a 
static named instance by removing the "$packet->sign_tsig(...)" line in 
the exploit.
So the scope of this issue is wider than apparent from the original 
report.


Robert

Attachment: signature.asc
Description: This is a digitally signed message part.