Re: "djbdns and nxdspecial patch"

On Mon, Apr 26, 2010 at 02:02:41PM -0400, Jeff King wrote:
> On Sat, Apr 24, 2010 at 07:40:52PM -0500, Mark Johnson wrote:
> > FYI, I don't think dbndns ever merged in all of Jeff King's patches
> > for CVE-2008-4392 (query merging).  I believe the maintainer, Gerrit
> > Pape, preferred a different solution.
> 
> I'm not sure if he ever implemented something different, but he was the
> one who brought up the lame server behavior (it's all in the list
> archives if anybody wants to know more).

I don't apply any of the patches from your.org, neither to the djbdns
package, which I didn't really consider, nor to the dbndns package,
because testing wasn't successful.

Back then I asked around for an exploit implementing the birthday attack
to actually see how it works out in practice, but got no response.  I
hacked such an exploit myself, and was able to poison dnscache through a
fast ethernet link within about 20 minutes using queries for uncached
SOA records.

Nevertheless I feel confident with djbdns 1.05 as is.  The exploit ran
in an ideal environment, numbers change if the dnscache is under load,
if different records than SOA are used, ...  To me the your.org
querymerge patch looks too intrusive, and I feel better without patching
djbdns.  The general cache poisoning vulnerability is well documented,
also by upstream.

The Debian security team doesn't share my opinion, and asked to fix the
vulnerability for djbdns to be released with the next stable release of
Debian.  I tried to convince them with a less intrusive patch that
exactly targets the exploit described in the your.org paper, "[PATCH]
dnscache.c: allow a maximum of 20 concurrent outgoing SOA queries",
which is applied to the dbndns package, not djbdns.  Unfortunately that
didn't convince them, and I finally stopped trying.  Sometimes there
simply is no good compromise, be it.  Part of this story can be read
here

 http://bugs.debian.org/516394


BTW, most of the information on

 http://linuxmafia.com/faq/Network_Other/dns-servers.html

about the Debian djbdns and dbndns packages is wrong, I'll notify the
author to have it corrected.

Regards, Gerrit.