oss-sec mailing list archives
Re: CVE Request New-djbdns: dnscache: potential cache poisoning
From: P J P <ppandit () redhat com>
Date: Mon, 10 Feb 2014 17:47:14 +0530 (IST)
+-- On Mon, 10 Feb 2014, Florian Weimer wrote --+ | How it is possible to poison the cache if the response is not cached? IIUC, response is cached, and cached in the same location. Because it 'hashes' to the same bucket always, an attacker is able to overwrite entries in that bucket by flooding a resolver with queries involving other domains whose resource records also 'hash' to the same bucket. As 'dnscache' does not go beyond 100 entries in this bucket, it is made to contact TLD servers for new requests. If this query pattern of 'dnscache' is predictable, it could be possible to poison it with usual response flood technique (of-course that's easier said than done). With 'SipHash' function, that 'bucket' selection is randomised. IOW, multiple queries with a same domain/key might 'hash' to different buckets. That's my understanding of the post. I'll check with the upstream author for more clarification. Thank you. -- Prasad J Pandit / Red Hat Security Response Team
Current thread:
- CVE Request New-djbdns: dnscache: potential cache poisoning P J P (Feb 09)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning Florian Weimer (Feb 10)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning P J P (Feb 10)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning P J P (Feb 10)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning Michael Samuel (Feb 11)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning P J P (Feb 11)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning P J P (Feb 11)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning Michael Samuel (Feb 11)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning P J P (Feb 11)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning P J P (Feb 17)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning Michael Samuel (Feb 17)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning P J P (Feb 18)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning P J P (Feb 10)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning Florian Weimer (Feb 10)
- Re: CVE Request New-djbdns: dnscache: potential cache poisoning Michael Samuel (Feb 11)