Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Nov 2014 12:15:56 +0100
From: Sebastian Krahmer <>
Subject: CVE-request: systemd-resolved DNS cache poisoning


systemd-resolved contains a caching resolver, which has to be enabled via
/etc/nsswitch.conf in order to be integrated.

Any local name resolvings via getaddrinfo() etc. are then routed via DBUS
to systemd-resolved which resolves the name and caches it according
to TTL from the answer.

However, systemd-resolved does not implement any of the hardening
recommendations of rfc5452.

At its simplest, an attacker triggers a query to a domain he controls
via SMTP or SSH-login. Upon receipt of the question, he can just add
any answer he wants to have cached to the legit answer he provides
for the query, e.g. providing two anser RR's: One for the question asked
and one for a question that has never been asked - even if the DNS server
is not authoritative for this domain.

The attacker would need to guess the source port of the origin since he only
sees the query from victims upstream DNS, but since systemd-resolved also uses fix
source ports, thats easy.
systemd-resolved creates cache entries soley from what is provided in
the DNS replies.

This issue has already been reported to upstream.

Thanks to Santa L. Helper for private discussion. 



~ perl
~ $_='print"\$_=\47$_\47;eval"';eval
~ - SuSE Security Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.