Date: Wed, 19 Feb 2014 17:12:48 -0500 (EST) From: cve-assign@...re.org To: ppandit@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request New-djbdns: dnscache: possible DoS -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > dnscache(8) resolver reads messages over a TCP connection one byte at a time. > For long messages, it'll trigger as many read(2) calls as the length of a > message. Thus consuming extra CPU cycles. A malicious remote user could use > this to cause a DoS. > https://github.com/pjps/ndjbdns/commit/a67293ce12832b55ec4271536282290ed17863f6 Changing the TCP read approach can be considered a performance improvement (and, somewhat marginally, a security improvement), with no CVE assignment. The commit mentions "making slight gain in performance" and "could also lead to potential denial of service." The original implementation might have chosen its approach for design-for-auditability reasons, i.e., it may not have been a "mistake" at all. It seems impractical to assign CVE IDs to all opportunities to speed up the processing of untrusted input in all products. The situation would be different if it were clearly a logic error in the code, e.g., processing the first byte once, the second byte four times, the third byte nine times, etc. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTBSsHAAoJEKllVAevmvmsuAEIAIeUgu7aq8joD+a0bHBhoHed Un8pGhWyjvPxYVbn6odNRfuT2nNanF2zL3MYOY5ZtXVWZQmqJVI/FSYVms9hrLhQ CVOyWTKltDbeh/AqgZSadMPmsprcT7XlIazDsJsL9YacGDLkM4cxraZXYP0rluUN tMLSQIlo83bVCUv4+cH2qP9dTDhGyXLuIUz5v4L8ni9blW0VC7SEvEzk6pLTvkn2 zPgI/X+dVRyxtEMk1T2ri4QObiL6NaZ2Eerd+I9Y8rGYpQH2XGyj3puhGroSmEuQ N1HKOkfyZqGH8JaAv5Y6Rz+Bgo+lMh1wT4Px4xXs9Rttgt3P0Ak8RGrKnTeTBGU= =6Jj8 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ