Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 28 Jul 2015 20:13:13 +0100
From: Kiall Mac Innes <>
Subject: Re: CVE Request - OpenStack Designate mDNS DoS through incorrect
 handling of large RecordSets

Hash: SHA256

On 28/07/15 19:57, wrote:
>> Designate does not enforce the DNS protocol limit concerning
>> record set sizes
>> As a result, the rendering loop in desginate-mdns can does not
>> make progress
>> Because it keeps receiving data, it does not seem it will ever
>> run into a timeout (and if it does, it will try again).
>> I think there is 2 parts to this bug:
>> 1: Quotas were being bypassed as part of the v1 API. 2. If there
>> was enough RRs in a RRSet MiniDNS went into a loop. 3. MiniDNS
>> does not have a timeout.
> Our current feeling is that it is best to have two CVE IDs: one
> for the original "does not enforce the DNS protocol limit
> concerning record set sizes" issue and one for the "Quotas were
> being bypassed" issue. Is that OK?

Yes, this is OK.

> [SNIP]
> We feel that item 3, adding a timeout, can be considered a
> security enhancement opportunity that should not have its own CVE
> ID, i.e., there is no report of a vulnerability that can be fixed
> only with a timeout.


> Finally, our understanding is that multiple names are being used to
> refer to the general 
> concept, i.e., we think "MiniDNS does not have a timeout" is an
> observation about the Designate codebase, not a third-party DNS
> server such as from the site.
> Also, we think this part of the Designate codebase is also called
> designate-mdns (misspelled as desginate-mdns) and mDNS -- these are
> essentially alternative names for Designate MiniDNS.

Interesting, is project I've not
seen before. Within OpenStack Designate, we typically refer to the
`designate-mdns` service as either MiniDNS or mDNS, we will need to
ensure we're clearer in our wording in future to avoid any possible

Version: GnuPG v2


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.