Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Nov 2014 12:15:56 +0100
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE-request: systemd-resolved DNS cache poisoning

Hi

systemd-resolved contains a caching resolver, which has to be enabled via
/etc/nsswitch.conf in order to be integrated.

Any local name resolvings via getaddrinfo() etc. are then routed via DBUS
to systemd-resolved which resolves the name and caches it according
to TTL from the answer.

However, systemd-resolved does not implement any of the hardening
recommendations of rfc5452.

At its simplest, an attacker triggers a query to a domain he controls
via SMTP or SSH-login. Upon receipt of the question, he can just add
any answer he wants to have cached to the legit answer he provides
for the query, e.g. providing two anser RR's: One for the question asked
and one for a question that has never been asked - even if the DNS server
is not authoritative for this domain.

The attacker would need to guess the source port of the origin since he only
sees the query from victims upstream DNS, but since systemd-resolved also uses fix
source ports, thats easy.
systemd-resolved creates cache entries soley from what is provided in
the DNS replies.

This issue has already been reported to upstream.

Thanks to Santa L. Helper for private discussion. 

Sebastian

-- 

~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ