Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Nov 2014 13:35:43 +0100
From: Florian Weimer <>
Subject: Re: CVE-request: systemd-resolved DNS cache poisoning

On 11/12/2014 12:15 PM, Sebastian Krahmer wrote:
> At its simplest, an attacker triggers a query to a domain he controls
> via SMTP or SSH-login. Upon receipt of the question, he can just add
> any answer he wants to have cached to the legit answer he provides
> for the query, e.g. providing two anser RR's: One for the question asked
> and one for a question that has never been asked - even if the DNS server
> is not authoritative for this domain.

BIND 9 is supposed to filter such garbage from upstream answers, but 
there are other resolvers out there which will pass through such answers 
unchanged, so this is very much CVE-worthy.

(This systemd component is optional, I strongly recommend not to ship 
it.  It's not even possible right now to dump the cache contents to 
debug such issues.)

Florian Weimer / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.