Re: djbdns misformats some long response packets; patch and example attack

On Wed, Feb 25, 2009 at 12:04:05AM -0800, Matthew Dempsky wrote:

> If a victim using dnscache now makes an A query for www.x.foo,
> dnscache will save the poisoned records, and begin contacting the
> attacker's nameservers for all .foo requests.  (The response will be
> over 512 bytes long, so dnscache will have to retry the query over
> TCP, which is why axfrdns is necessary too.)

Can you clarify the interaction of this bug with dnscache?

From your patch, the bug seems to be in response_addname. Your attack
scenario seems to be to get a victim tinydns server (which uses
response_addname when generating a response) to serve your bogus
records. Is the result a problem for all resolvers, or just dnscache?

What if these bogus records are served by a patched tinydns (or another
authoritative server) to dnscache? It looks like dnscache uses
response_addname when sending the answer back to the original querier,
but _not_ when caching.

I haven't had time to look more deeply or experiment, but I'm hoping you
know the answers to these already. If not, I'll try to take a look in
the next few days.

-Peff