[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Nov 2014 12:15:56 +0100
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE-request: systemd-resolved DNS cache poisoning
Hi
systemd-resolved contains a caching resolver, which has to be enabled via
/etc/nsswitch.conf in order to be integrated.
Any local name resolvings via getaddrinfo() etc. are then routed via DBUS
to systemd-resolved which resolves the name and caches it according
to TTL from the answer.
However, systemd-resolved does not implement any of the hardening
recommendations of rfc5452.
At its simplest, an attacker triggers a query to a domain he controls
via SMTP or SSH-login. Upon receipt of the question, he can just add
any answer he wants to have cached to the legit answer he provides
for the query, e.g. providing two anser RR's: One for the question asked
and one for a question that has never been asked - even if the DNS server
is not authoritative for this domain.
The attacker would need to guess the source port of the origin since he only
sees the query from victims upstream DNS, but since systemd-resolved also uses fix
source ports, thats easy.
systemd-resolved creates cache entries soley from what is provided in
the DNS replies.
This issue has already been reported to upstream.
Thanks to Santa L. Helper for private discussion.
Sebastian
--
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
