oss-sec mailing list archives
CVE-request: systemd-resolved DNS cache poisoning
From: Sebastian Krahmer <krahmer () suse de>
Date: Wed, 12 Nov 2014 12:15:56 +0100
Hi systemd-resolved contains a caching resolver, which has to be enabled via /etc/nsswitch.conf in order to be integrated. Any local name resolvings via getaddrinfo() etc. are then routed via DBUS to systemd-resolved which resolves the name and caches it according to TTL from the answer. However, systemd-resolved does not implement any of the hardening recommendations of rfc5452. At its simplest, an attacker triggers a query to a domain he controls via SMTP or SSH-login. Upon receipt of the question, he can just add any answer he wants to have cached to the legit answer he provides for the query, e.g. providing two anser RR's: One for the question asked and one for a question that has never been asked - even if the DNS server is not authoritative for this domain. The attacker would need to guess the source port of the origin since he only sees the query from victims upstream DNS, but since systemd-resolved also uses fix source ports, thats easy. systemd-resolved creates cache entries soley from what is provided in the DNS replies. This issue has already been reported to upstream. Thanks to Santa L. Helper for private discussion. Sebastian -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer () suse de - SuSE Security Team
Current thread:
- CVE-request: systemd-resolved DNS cache poisoning Sebastian Krahmer (Nov 12)
- Re: CVE-request: systemd-resolved DNS cache poisoning Florian Weimer (Nov 12)
- Re: CVE-request: systemd-resolved DNS cache poisoning Sebastian Krahmer (Nov 12)
- Re: CVE-request: systemd-resolved DNS cache poisoning cve-assign (Nov 12)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Florian Weimer (Nov 13)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Daniel Kahn Gillmor (Nov 13)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Jeremy Stanley (Nov 13)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Sebastian Krahmer (Nov 14)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Greg KH (Nov 14)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Florian Weimer (Nov 17)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Florian Weimer (Nov 13)
- Re: CVE-request: systemd-resolved DNS cache poisoning Florian Weimer (Nov 12)