Security News > 2009 > March > Security issue in djbdns confirmed

http://securityandthe.net/2009/03/05/security-issue-in-djbdns-confirmed/ Security and the Net Mar. 05, 2009 Last week, Matthew Dempsky posted an attack against Dan Bernstein.s djbdns software. Djbdns is one of several alternatives for the popular BIND nameserver, and is backed by a unique security guarantee that offers $1000 to the first person to publicly report a verifiable security hole in djbdns. The problem found by Dempsky allows an attacker to poison DNS records: The security hole here is that an administrator that uses djbdns 1.05 to serve DNS content does not expect that configuring his name server as above will cause it to send records for names outside of burlap.dempsky.org. I.e., an attacker can trick the administrator.s name servers to include arbitrary DNS records in response to queries for names within domains he controls. Less than a week later, D.J. Bernstein has acknowledged that this was indeed a security issue: Even though this bug affects very few users, it is a violation of the expected security policy in a reasonable situation, so it is a security hole in djbdns. Third-party DNS service is discouraged in the djbdns documentation but is nevertheless supported. Dempsky is hereby awarded $1000. There will be a new release of djbdns soon that will fix this bug and will come with a new security guarantee. This is a big contrast with the way a supposed security issue in qmail was handled. In that case, Bernstein denied there was a security issue because "Nobody gives gigabytes of memory to each qmail-smtpd process, so there is no problem with qmail's assumption that allocated array lengths fit comfortably into 32 bits." [...] _______________________________________________ Best Selling Security Books and More! http://www.shopinfosecnews.org/

News URL

http://securityandthe.net/2009/03/05/security-issue-in-djbdns-confirmed/