djbdns Security
This past Tuesday, March 3rd, 2009 was somewhat of a momentous day. It marked the end of a security hole free run for the djbdns package that started way back in February 11, 2001. That's over 8 years without a security related issue discovered in the code! In Internet time, that's quite simply an eternity.
djbdns is a DNS software package written by Dan Bernstein of the University of Illinois at Chicago. It replaces the functionality of BIND, the Internet's most popular DNS server. However, while popular, BIND has had some fairly serious security holes in its lifetime. They include a number of root exploits and various cache poisoning exploits like the one uncovered by Dan Kamainsky that threatened to take down the entire Internet! djbdns had classically been immune to these attacks and offered as close to a "set it up and forget it" DNS server as you could get. Dan backed up his software by offering a $1,000 prize to the person who could demonstrate a security flaw in the software.
However, this past Tuesday, Dan confirmed a security flaw had been found in a post to the gmane.network.djbdns newsgroup and awarded $1,000 to Matt Dempsky who found the bug. The flaw is exposed only when a tinydns server delegates authority for a subdomain of the main domain to an un-trusted third party. The bug effectively enabled the third party to cache (and therefor modify) names in the parent domain. Of course you would have to have a delegation like this and ask that sub-domain server for a name that is usually served by the main server as well so this flaw isn't major by any stretch of the imagination. It does, however, violate the trust relationship and is therefor a security hole.
Dan will be releasing an updated version of djbdns but you can patch the existing latest version of djbdns (1.0.5) with the following:
--- response.c.orig 2009-02-24 21:04:06.000000000 -0800
+++ response.c 2009-02-24 21:04:25.000000000 -0800
@@ -34,7 +34,7 @@
uint16_pack_big(buf,49152 + name_ptr[i]);
return response_addbytes(buf,2);
}
- if (dlen <= 128)
+ if ((dlen <= 128) && (response_len < 16384))
if (name_num < NAMES) {
byte_copy(name[name_num],dlen,d);
name_ptr[name_num] = response_len;
Tags
djbdns security BINDTrackbacks
To send a trackback, use the URL of this story appending ?page=tb at the end.Comments (0)
Leave a Comment
To create links in comments:
[link:http://www.anders.com/] becomes http://www.anders.com/
[link:http://www.anders.com/|Anders.com] becomes Anders.com
Notice there is no rel="nofollow" in these hrefs. Links in comments will carry page rank from this site so only link to things worthy of people's attention.
subscribe
