[Bug network/34345] New: res_queriesmatch mishandles ternary return value of res_nameinquery

https://sourceware.org/bugzilla/show_bug.cgi?id=34345

            Bug ID: 34345
           Summary: res_queriesmatch mishandles ternary return value of
                    res_nameinquery
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: network
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---
             Flags: security-

The res_nameinquery function returns -1 if the packet is corrupted. In
res_queriesmatch, this is treated as a match (true return value).

This is not a security vulnerability because the transaction ID is still
checked. The bug makes off-path attacks not substantially easier. Furthermore,
most users of the DNS stub resolver parse the question name again, and do not
simply skip over it using dn_skipname or similar (which would hide the
corruption). This means that the packet is still rejected at a later stage.

-- 
You are receiving this mail because:
You are on the CC list for the bug.