[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 03 Nov 2016 17:26:27 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: [SECURITY ADVISORY] IDNA 2003 makes curl use wrong host
* Daniel Stenberg:
> When curl is built with libidn to handle International Domain Names
> (IDNA), it translates them to puny code for DNS resolving using the
> IDNA 2003 standard, while IDNA 2008 is the modern and up-to-date
> IDNA standard.
I think everyone in the software space assumes that all DNS registries
block registrations which would allocate names colliding under the
IDNA 2003 and 2008 standards to different owners. There were even
attempts at the registry level to automatically alias different
encodings (something which is difficult because it interferes with the
goal to make the whole thing application-centric).
> For example, `straße.de` is translated into `strasse.de` using IDNA
> 2003 but is translated into `xn--strae-oqa.de` using IDNA
> 2008. Needless to say, those host names could very well resolve to
> different addresses and be two completely independent servers. IDNA
> 2008 is mandatory for .de domains.
What does DENIC say about this matter? It looks like their
implementation of IDNA is just very broken.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
