Date: Tue, 9 Dec 2014 09:22:28 +0100 From: Hanno Böck <hanno@...eck.de> To: Peter van Dijk <peter.van.dijk@...herlabs.nl> Cc: oss-security@...ts.openwall.com Subject: Re: PowerDNS Security Advisory 2014-02 On Tue, 9 Dec 2014 08:16:20 +0100 Peter van Dijk <peter.van.dijk@...herlabs.nl> wrote: > Somebody asked me to (help him) check djbdns today, which we’ll do. > Any other implementations you are interested in? I have a lab setup > for this issue so I’m happy to check. I think dnsmasq would be interesting. Don't know which servers from the proprietary world may be worth investigating. > > And is this only a DoS for the attacked server or would it also > > allow some completely new kind of DNS reflection attack (i.e. > > generating a loop where every loop iteration generates an UDP > > packet send to a victim)? > > I’m convinced the loop could involve unwilling victims (unless they > send responses that break the loop!), but I have not tried this in > practice. However that would be very interesting to know. DNS reflection attacks are a big thing, if they could be amplified with a loop on the resolver that'd almost certainly boost this issue to a whole new level. -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.