oss-sec mailing list archives
Re: CVE-request: systemd-resolved DNS cache poisoning
From: Sebastian Krahmer <krahmer () suse de>
Date: Wed, 12 Nov 2014 13:48:29 +0100
On Wed, Nov 12, 2014 at 01:35:43PM +0100, Florian Weimer wrote:
On 11/12/2014 12:15 PM, Sebastian Krahmer wrote:At its simplest, an attacker triggers a query to a domain he controls via SMTP or SSH-login. Upon receipt of the question, he can just add any answer he wants to have cached to the legit answer he provides for the query, e.g. providing two anser RR's: One for the question asked and one for a question that has never been asked - even if the DNS server is not authoritative for this domain.BIND 9 is supposed to filter such garbage from upstream answers, but there are other resolvers out there which will pass through such answers unchanged, so this is very much CVE-worthy.
You may answer to the resolver directly, bypassing any filtering. Even behind a NAT this may work (depending on your DNS setup if theres no intermediate DNS server). In the mail-server example the local UDP port should be reachable directly, so you can spoof to be the legit DNS upstream and do not even are on race, since upstream DNS will wait for your legit answer while you are enumerating the XIDs through systemd (constant src port). Sebastian -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer () suse de - SuSE Security Team
Current thread:
- CVE-request: systemd-resolved DNS cache poisoning Sebastian Krahmer (Nov 12)
- Re: CVE-request: systemd-resolved DNS cache poisoning Florian Weimer (Nov 12)
- Re: CVE-request: systemd-resolved DNS cache poisoning Sebastian Krahmer (Nov 12)
- Re: CVE-request: systemd-resolved DNS cache poisoning cve-assign (Nov 12)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Florian Weimer (Nov 13)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Daniel Kahn Gillmor (Nov 13)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Jeremy Stanley (Nov 13)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Sebastian Krahmer (Nov 14)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Greg KH (Nov 14)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Florian Weimer (Nov 17)
- Re: Re: CVE-request: systemd-resolved DNS cache poisoning Florian Weimer (Nov 13)
- Re: CVE-request: systemd-resolved DNS cache poisoning Florian Weimer (Nov 12)