Re: CVE request New-djbdns: dnscache: possible DoS

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> dnscache(8) resolver reads messages over a TCP connection one byte at a time.
> For long messages, it'll trigger as many read(2) calls as the length of a
> message. Thus consuming extra CPU cycles. A malicious remote user could use
> this to cause a DoS.

> https://github.com/pjps/ndjbdns/commit/a67293ce12832b55ec4271536282290ed17863f6

Changing the TCP read approach can be considered a performance
improvement (and, somewhat marginally, a security improvement), with
no CVE assignment. The commit mentions "making slight gain in
performance" and "could also lead to potential denial of service." The
original implementation might have chosen its approach for
design-for-auditability reasons, i.e., it may not have been a
"mistake" at all. It seems impractical to assign CVE IDs to all
opportunities to speed up the processing of untrusted input in all
products. The situation would be different if it were clearly a logic
error in the code, e.g., processing the first byte once, the second
byte four times, the third byte nine times, etc.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTBSsHAAoJEKllVAevmvmsuAEIAIeUgu7aq8joD+a0bHBhoHed
Un8pGhWyjvPxYVbn6odNRfuT2nNanF2zL3MYOY5ZtXVWZQmqJVI/FSYVms9hrLhQ
CVOyWTKltDbeh/AqgZSadMPmsprcT7XlIazDsJsL9YacGDLkM4cxraZXYP0rluUN
tMLSQIlo83bVCUv4+cH2qP9dTDhGyXLuIUz5v4L8ni9blW0VC7SEvEzk6pLTvkn2
zPgI/X+dVRyxtEMk1T2ri4QObiL6NaZ2Eerd+I9Y8rGYpQH2XGyj3puhGroSmEuQ
N1HKOkfyZqGH8JaAv5Y6Rz+Bgo+lMh1wT4Px4xXs9Rttgt3P0Ak8RGrKnTeTBGU=
=6Jj8
-----END PGP SIGNATURE-----