July 2002 - openSUSE Security - openSUSE Mailing Lists

Bind9 & resolver libs
by andre 03 Jul '02

03 Jul '02

if set in resolv.conf to 127.0.0.1 and in named.conf recursion no; it should be fine ? afaik the problem is that querries on > bind8 is answered from the resolver libs and bind9 only answers from cache ? tia andre

1 0

Gobbles Apache Exploit
by Patrik Breitenmoser 03 Jul '02

03 Jul '02

Hi, I was just wondering if my patched apache on suse 7.3 is save against that exploit. regards Patrik

2 1

root-rechte
by rutger 03 Jul '02

03 Jul '02

hallo liste, wie kann man eine root-datei löschen, wenn sie nur lese und ausführen für root hat - also r-x------ . vielen dank, r.frechen

6 8

SuSE-SA:2002:023
by Alexander Schiftner 02 Jul '02

02 Jul '02

Hi! Can somenody explain why I can not find the rpms for i386 as described in the Security Announcement ? On ftp.suse.com I can only find ftp://ftp.suse.com/pub/suse/i386/update/7.3/sec1/openssh-2.9.9p2-102.i386.r… Thanx, Alex -------- Alexander Schiftner Support Austrosoft Weiss Datenverarbeitung GmbH Hietzinger Hauptstrasse 33 1130 Wien / Austria Phone: +43 - 1 - 8776205 - 17 Fax: +43 - 1 - 8776205 - 21 mailto:alexander.schiftner@austrosoft.at http://www.austrosoft.at

4 3

english list
by rutger 02 Jul '02

02 Jul '02

hello all, thanx for reminding me, that this is an english list. i forgot while thinking about the problem. sorry for the inconvenience, r.frechen

1 0

Apache upgrade from SuSE ?
by Felix Seeger 02 Jul '02

02 Jul '02

Hi I've downloaded an Apache update from SuSE. It is for SuSE Linux 7.0. The version of apache is 1.3.19. Is this the right version against the new apache worm ? Apachetoday.com means that I have to upgrade to 1.3.26 but there is only a package for 8.0. Is this a special SuSE patched version ? thanks have fun Felix

6 7

OpenSSH
by christian.burri＠synecta.ch 02 Jul '02

02 Jul '02

Hi list, I have a SuSE 7.3 box here, and after updating sshd via YOU, something weird happened. It seemed so weird to me that I decided to post it here. The 7.3 box is a firewall, it links three seperate networks to the internet. My home LAN is one of these networks, I have to add. Now that I updated the box, it locked up pretty soon with an Oops message. I restarted it and it seemed to work fine, Therefore, I went home after a while and got a bit on IRC and texted wif some of my friends when suddenly my session would disconnect. Well, the uplink to the ISP is kinda "OEM" ADSL, it is provided by our national telco to the ISP, which in turn resells the connection to us, thus the ISP doesnt have to run lines down to every building in the country. So far so good, this line is quite the crap when compared to a real leased line, it goes down alot for short moments etc; they blame it on capacity problems. Thus I tought the line would be just down due to "normal behaviour" and come back up after a short while. But this wasnt so. The line was down, and it didnt look like it would come back up by itself. So I went to my other connection (cable) and tried to ping the traceroute to my inner firewall. The result was that the packets stopped at mentioned suse 7.3 box. Therefore I tried to ping the machine, to no avail. I also tried logging in via SSH, that didnt work either. So I assumed that the box would simply have Oops'd again. I couldnt login to it, neither from my LAN side, nor from the internet side, and it didnt even reply to pings. But suddenly... I noticed, while being on the computer with the cable connection, that I was still logged in to my webserver box, that is attached to the same LAN as my workstation is (where I irc'd from) ! Now what the fsck?? It was definately responsive, I could type commands and it gave me output. So I tried to establish another SSH session, which wouldnt work either! Now, as if this werent strange enough, I logged in to the inner firewall from the webserver box, also via ssh, and tried to login to said suse 7.3 firewall from the inner firewall (which has a connection to the suse 7.3 firewall via SDSL). And that worked. The box that didnt reply to pings, nor route my traffic from the LAN to the internet or vice versa, it gave me a login prompt. So I logged on, and looked at logs, but there was nothing unusual, no suspicious messages or anything. I looked at route -n and also at netstat -a and nothing appeared to be wrong. So I did rcnetwork restart. And all of a sudden, my connectivity was restored, IRC reconnected etc. Very very very very weird. I might add that such things never happened before I updated sshd. Cheers Chris Burri .-. /v\ L I N U X // \\ >I know KungFu!!< /( )\ ^^-^^

4 3

Re: AW: [suse-security] root-rechte
by Stefan Nowak 02 Jul '02

02 Jul '02

Maybe he was astonished deleting a file of root with a non-root account... sag@integra:/tmp/rmtest > ls -al Gesamt 32 drwxr-xr-x 2 sag other 178 Jul 2 18:10 . drwxrwxrwt 9 root sys 1821 Jul 2 18:10 .. -r-x------ 1 root root 0 Jul 2 18:10 test sag@integra:/tmp/rmtest > rm test rm: test: Schutz 500 (yes/no) übergehen? y sag@integra:/tmp/rmtest > ls -al Gesamt 32 drwxr-xr-x 2 sag other 117 Jul 2 18:11 . drwxrwxrwt 9 root sys 1821 Jul 2 18:10 .. Greetings, Stefan Cristian Ion schrieb: > > Hi! > > su - > rm -f $file > > or > > su - > chmod 700 $file > rm $file > > or ... > > etc, etc, etc. > > Sure, if you're root on the box... > > Or did I understand something else? > > Cristian > > > > > rutger schrieb: > > > > > > hallo liste, > > > > > > wie kann man eine root-datei löschen, wenn sie > > > nur lese und ausführen für root hat - also r-x------ . > > > vielen dank, r.frechen > > > > > > > Hi Schreiber, > > > > Mit rm wenn Du schreibrechte für das Verzeichnis hast, in dem > > die Datei > > liegt. Oder habe ich die Frage absolut falsch verstanden?! Verstehe > > nämlich den Zusammenhang nicht... ? > > > > Grüße, > > > > Stefan Nowak > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > -- Stefan Nowak Dipl.-Ing. (BA) Technologieberater SAG Systemhaus GmbH Alt-Moabit 96, D-10559 Berlin Telefon +49-30-390 903-206, Fax -250

1 0

UDP security
by Pacifico Chavez 02 Jul '02

02 Jul '02

Hi!! I'm Getting messages like in log: kernel: UDP: short packet: 556/548 other numbers also frequently show up: 0/141 1900/141 What could this be? Thank you for your assistance ----------------------------------------------------------- Pacifico ----------------------------------------------------------- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

apache chroot
by Patrik Breitenmoser 02 Jul '02

02 Jul '02

Hi all, after jailing my bind installation, ist there a howto how to chroot the apache webserver? Any link would be great. thanks patrik

2 1

vsftpd in chroot enviromend
by Matthias Krauss 02 Jul '02

02 Jul '02

Hello List, does anybody noticed a way howto configure vsftpd in that way that i can run eg. 3 different usergroups in independent chroot areas, so that they not only have their home drive, like a own directory structure but jailed in a chroot area, this config was possible with wu-ftp, like configuring a guest group and jail them like /intern/./home/user . Thanks Matthias

2 1

SuSEFirewall Redirector Problem
by mbauer＠in-sight.de 02 Jul '02

02 Jul '02

Hi there List, I'm trying to redirect all hosts in my intranet through a squid, that also runs the firewall box. Here ist the line I used for redirecting: #****************************************************************************************************** FW_REDIRECT="198.201.201.0/24,0/0,tcp,80,8080" #****************************************************************************************************** I should work, but the only answer I get from my squid is this: While trying to retrieve the URL: / The following error was encountered: Invalid URL Some aspect of the requested URL is incorrect. Possible problems: Missing or incorrect access protocol (should be `http://'' or similar) Missing hostname Illegal double-escape in the URL-Path Illegal character in hostname; underscores are not allowed Your cache administrator is mbauer(a)in-sight.de. What have I done wrong ? Ain't it possible to redirect normal traffic from port 80 to 8080 ? thanks........ maX Bauer InSight Education GmbH 069 - 587098-90 mbauer(a)in-sight.de

3 2

Re: [suse-security] SuSEFirewall Redirector Problem
by mbauer＠in-sight.de 02 Jul '02

02 Jul '02

thank you for the quick answer. here's the URL to a good howto (german). It works. maX Bauer InSight Education GmbH 069 - 587098-90 mbauer(a)in-sight.de

1 0

Re: [suse-security] APACHE_access_log
by Oliver Bleutgen 02 Jul '02

02 Jul '02

> Greetings, > anyone know what these are? > 208.198.164.131 - - [28/Jun/2002:15:37:41 -0700] "-" 408 - > 208.198.164.131 - - [28/Jun/2002:15:39:12 -0700] "-" 408 - > 208.198.164.131 - - [28/Jun/2002:15:40:42 -0700] "-" 408 - > 208.198.164.131 - - [28/Jun/2002:17:07:43 -0700] "-" 408 - > 208.198.164.131 - - [28/Jun/2002:17:09:13 -0700] "-" 408 - > 208.198.164.131 - - [28/Jun/2002:17:10:43 -0700] "-" 408 - > 208.198.164.131 - - [28/Jun/2002:17:12:14 -0700] "-" 408 - > 208.198.164.131 - - [28/Jun/2002:17:13:44 -0700] "-" 408 - > 208.198.164.131 - - [28/Jun/2002:17:15:14 -0700] "-" 408 - > 208.198.164.131 - - [28/Jun/2002:17:16:44 -0700] "-" 408 - > 208.198.164.131 - - [28/Jun/2002:17:18:17 -0700] "-" 408 - > 208.198.164.131 - - [28/Jun/2002:17:19:46 -0700] "-" 408 - > 208.198.164.131 - - [28/Jun/2002:17:21:16 -0700] "-" 408 - > I know what 408 means... > 408 The Request timed out. For some reason the Server took too much time > processing your Request. Net congestion is the most likely reason. > Show me how to make the above entries in the access logs. I don't need to > be > educated about Status Codes, I need to know what kind of attack this is. > (I > know others that have it in their logs also) > Trying 192.168.10.2... > Connected to silver. > Escape character is '^]'. > - > and this gave me a log with this: > 192.168.0.2 - - [01/Jul/2002:16:13:30 -0700] "-" 200 2447 > which is similar, but not quite the same. So that makes me think it's not > a > browser doing it. cause a browser puts a "GET /- HTTP/1.2" 404 7240 > in the log. Try http://localhost/- and see what I mean. Are you filtering incoming http-request somehow? Like for nimda requests or stuff? This could mean that you just see the syn/ack part of an attack. Or perhaps just a nimda infected host which has a memory leak ;-) and can't compete the requests. As for how to produce a log entry like that: 1. bleutgen@baal:~ > telnet localhost 80 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 2. do nothing 3. repeat 2 until something happens 4. the shell will close after some time (apache's timeout, can be up to 5mins) 5. apache log: 127.0.0.1 - - [02/Jul/2002:08:18:02 +0200] "-" 408 - cheers, oliver

1 0

RE: [suse-security] What's the length of ssh keys? - Breakability of 1024bit RSA keys
by bliss＠attbi.com 02 Jul '02

02 Jul '02

There has been a fair amount of discussion about the Bernstein paper which was published last fall. Here are a few articles I founds which give both sides. You can decide for your self. The question is, are you secrets worth someone spending hundreds of millions (or billions) of dollars to crack to key to receive? If not, then there is probably no worry TODAY (but there is always tomorrow). Articles: http://www.vnunet.com/News/1130451 http://www.rsasecurity.com/rsalabs/technotes/bernstein.html http://www.eweek.com/article2/0,3959,99158,00.asp For some REALLY lite reading, here is a link to Bernstein's paper: http://cr.yp.to/papers.html#nfscircuit Enjoy the reading. Jim > There was a thread on Bugtraq, the initial post of which I cant seem to > find, but one had this link to an article: > > http://www.eweek.com/article2/0,3959,99158,00.asp > > I do recall the estimated cost to implement using off-the-shelf components > to be incredibly (phenomenally, astronomically) high, but on a par with the > money already invested by certain government's security organizations in > satellite surveillance technology. It is, after all, all relative :) > > Wish I could find you the original post, but for some reason I only kept the > replies.. > > -----Original Message----- > From: arawak [mailto:arawak@blueyonder.co.uk] > Sent: Tuesday, July 02, 2002 10:07 AM > To: suse-security(a)suse.com > Subject: RE: [suse-security] What's the length of ssh keys? > > > > > How much computing power would it take to crack an 1024bit key in a > reasonable amount of time? > > I thought it would be many years before it could be done, for it to be > of any use to anyone? > > I have not seen nor heard any info that it has been done as yet... > > Dre :o) > > Luck is my game ;-) > Linux is my aim :) > > -----Original Message----- > From: Austin Morgan [mailto:admorgan@morgancomputers.net] > Sent: 02 July 2002 00:24 > To: suse-security(a)suse.com > Subject: Re: [suse-security] What's the length of ssh keys? > > > While it is true it is possible to break an 1024bit key, it is also > difficult. While I am not saying that going to an higher bit key is a > bad idea it is also proabably not really necessary. Also ssh is based > on ssl so what effects one (as far as keys) effects the other. > > Austin Morgan > > On Mon, Jul 01, 2002 at 06:23:45PM +0200, Praise wrote: > > A friend of mine told me that 1024bit keys were broken, and he advised > > > me to use 4096bit keys... I think he is confusing ssl with ssh. > > Do you have similar information on this? > > > > Praise > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here

1 0

MD5 password confirmation fails after update to OpenSSH 3.3 on SuSE 7.3
by Thomas Föcking 02 Jul '02

02 Jul '02

Hello, this morning I updated all linux servers running SuSE 7.3 to OpenSSH 3.3. Now I am not able to login via ssh anymore - password confirmation fails. First I tought, that sshd is not allowed to read /etc/shadow, but this was not the case. "harden_suse" made my /etc/shadow passwords be encrypted with MD5. After adding a new user with yast the new user's password was only DES encrypted. With this user I am able to login, with users who has got MD5 encrypted passwords I'm not able to login via ssh. Am I right, that the new sshd has got problems with MD5 password? What can I do now? Regards, Thomas

3 2

RE: [suse-security] What's the length of ssh keys? - Breakability of 1024bit RSA keys
by Paxton, Michael 02 Jul '02

02 Jul '02

There was a thread on Bugtraq, the initial post of which I cant seem to find, but one had this link to an article: http://www.eweek.com/article2/0,3959,99158,00.asp I do recall the estimated cost to implement using off-the-shelf components to be incredibly (phenomenally, astronomically) high, but on a par with the money already invested by certain government's security organizations in satellite surveillance technology. It is, after all, all relative :) Wish I could find you the original post, but for some reason I only kept the replies.. -----Original Message----- From: arawak [mailto:arawak@blueyonder.co.uk] Sent: Tuesday, July 02, 2002 10:07 AM To: suse-security(a)suse.com Subject: RE: [suse-security] What's the length of ssh keys? How much computing power would it take to crack an 1024bit key in a reasonable amount of time? I thought it would be many years before it could be done, for it to be of any use to anyone? I have not seen nor heard any info that it has been done as yet... Dre :o) Luck is my game ;-) Linux is my aim :) -----Original Message----- From: Austin Morgan [mailto:admorgan@morgancomputers.net] Sent: 02 July 2002 00:24 To: suse-security(a)suse.com Subject: Re: [suse-security] What's the length of ssh keys? While it is true it is possible to break an 1024bit key, it is also difficult. While I am not saying that going to an higher bit key is a bad idea it is also proabably not really necessary. Also ssh is based on ssl so what effects one (as far as keys) effects the other. Austin Morgan On Mon, Jul 01, 2002 at 06:23:45PM +0200, Praise wrote: > A friend of mine told me that 1024bit keys were broken, and he advised > me to use 4096bit keys... I think he is confusing ssl with ssh. > Do you have similar information on this? > > Praise -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

APACHE_access_log
by phil 02 Jul '02

02 Jul '02

Greetings, anyone know what these are? 208.198.164.131 - - [28/Jun/2002:15:37:41 -0700] "-" 408 - 208.198.164.131 - - [28/Jun/2002:15:39:12 -0700] "-" 408 - 208.198.164.131 - - [28/Jun/2002:15:40:42 -0700] "-" 408 - 208.198.164.131 - - [28/Jun/2002:17:07:43 -0700] "-" 408 - 208.198.164.131 - - [28/Jun/2002:17:09:13 -0700] "-" 408 - 208.198.164.131 - - [28/Jun/2002:17:10:43 -0700] "-" 408 - 208.198.164.131 - - [28/Jun/2002:17:12:14 -0700] "-" 408 - 208.198.164.131 - - [28/Jun/2002:17:13:44 -0700] "-" 408 - 208.198.164.131 - - [28/Jun/2002:17:15:14 -0700] "-" 408 - 208.198.164.131 - - [28/Jun/2002:17:16:44 -0700] "-" 408 - 208.198.164.131 - - [28/Jun/2002:17:18:17 -0700] "-" 408 - 208.198.164.131 - - [28/Jun/2002:17:19:46 -0700] "-" 408 - 208.198.164.131 - - [28/Jun/2002:17:21:16 -0700] "-" 408 - I know what 408 means... 408 The Request timed out. For some reason the Server took too much time processing your Request. Net congestion is the most likely reason. Show me how to make the above entries in the access logs. I don't need to be educated about Status Codes, I need to know what kind of attack this is. (I know others that have it in their logs also) Trying 192.168.10.2... Connected to silver. Escape character is '^]'. - and this gave me a log with this: 192.168.0.2 - - [01/Jul/2002:16:13:30 -0700] "-" 200 2447 which is similar, but not quite the same. So that makes me think it's not a browser doing it. cause a browser puts a "GET /- HTTP/1.2" 404 7240 in the log. Try http://localhost/- and see what I mean. I start thinkin...hmm It COULD be that since that bastard has his ping turned off that it takes so long to get a response that apache times out. echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all telnet silver 80 Trying 192.168.10.2... Connected to silver. Escape character is '^]'. - same result: 192.168.0.2 - - [01/Jul/2002:16:37:05 -0700] "-" 200 2447 so it ain't that. (Be sure and do echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all ) I tried netcat echo - | netcat -i 60 192.168.10.2 80 and it looks just like those telnet results. I tried compiling apache-worm.c http://dammit.lt/apache-worm/apache-worm.c I don't get nothing in my logs at all from apache-worm and besides it's writes totally diferent than what I am talking about anyway. Please, what kind of attack is this? regards phil

1 0

RE: [suse-security] What's the length of ssh keys?
by arawak 02 Jul '02

02 Jul '02

How much computing power would it take to crack an 1024bit key in a reasonable amount of time? I thought it would be many years before it could be done, for it to be of any use to anyone? I have not seen nor heard any info that it has been done as yet... Dre :o) Luck is my game ;-) Linux is my aim :) -----Original Message----- From: Austin Morgan [mailto:admorgan@morgancomputers.net] Sent: 02 July 2002 00:24 To: suse-security(a)suse.com Subject: Re: [suse-security] What's the length of ssh keys? While it is true it is possible to break an 1024bit key, it is also difficult. While I am not saying that going to an higher bit key is a bad idea it is also proabably not really necessary. Also ssh is based on ssl so what effects one (as far as keys) effects the other. Austin Morgan On Mon, Jul 01, 2002 at 06:23:45PM +0200, Praise wrote: > A friend of mine told me that 1024bit keys were broken, and he advised > me to use 4096bit keys... I think he is confusing ssl with ssh. > Do you have similar information on this? > > Praise -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

firewall problem
by Thomas Nyman 01 Jul '02

01 Jul '02

Hi, I have a problem with my SuSEfirewall2..despite reading the examples and faq I cant get it to allow incoming and otugoing traffic on port 25 the firewall is run on a machine configured as follows eth0 = external network (internet) eth1 = internal network (192.168.1.1) the machine runs postfix and postfix can't open port 25. I've enclosed my firewall script..I'm hoping someone can see what I've done wrong. Thomas -------------------------------------------------------

4 4

SSH connection SunOS -> Linux fails
by Heiko Heil 01 Jul '02

01 Jul '02

Hello (Open-)SHH-users, after updating my Linux-sshd (OpenSSH_3.4p1, SSH protocols 1.5/2.0, OpenSSL 0x0090604f) ...I couldn't connect from my SunOS 5.8-account: elvis@ant$ ssh -V ssh: SSH Version 2.0.13 elvis@ant$ ssh -v XXXX(a)XXXXXXXXXX.dyndns.org Development-time debugging not compiled in. To enable, configure with --enable-debug and recompile. debug: hostname is 'XXXXXXXXXX.dyndns.org'. debug: Unable to open /home/inf/heil/.ssh2/ssh2_config Development-time debugging not compiled in. To enable, configure with --enable-debug and recompile. debug: connecting to XXXXXXXXXX.dyndns.org... debug: entering event loop debug: ssh_client_wrap: creating transport protocol debug: ssh_client_wrap: creating userauth protocol debug: client_disconnect: Algorithm negotiation failed. Disconnected; key exchange or algorith negotiation failed (Algorithm negotiation failed.). debug: uninitializing event loop elvis@ant$ I didn't find anything any hints via groups.google :-( -- Cheers, Heiko Heil

2 1

Re: CERT Advisory CA-2002-19
by Michael Ryan 01 Jul '02

01 Jul '02

I'm running BIND 8.2.3 (libc-2.1.3) on a 6.4 box. Should I be worried ;-/ Thanks, Michael

1 0

Buffer Overflows in resolver libs, was: FW: Packet reconstruction i
by Reckhard, Tobias 01 Jul '02

01 Jul '02

Hi I'm forwarding this from the (DJB-) DNS mailing list, since one of the more knowledgeable guys there disagrees with CERT, saying that the problem doesn't lie in the DNS packets, but in the resolver library alone and that inserting a DNS cache won't necessarily help. But read itfor yourself (and sorry about Lookout's crappy quoting): > -----Original Message----- > From: Jonathan de Boyne Pollard [mailto:J.deBoynePollard@tesco.net] > Sent: Thursday, June 27, 2002 23:39 > To: DJBDNS Mailing List > Subject: Re: Packet reconstructioni > > > DP> The point is, of course, that if the packet is reconstructed > DP> the padding bytes will be different from the original reply, > DP> and this may help to spoil attacks; [...] > > DNS datagrams do not contain "padding bytes", nor do they > have alignment > requirements. The only padding and alignment that is > involved here is that in > the in-memory data structures passed between the BIND DNS > Client library, that > is shipped with the C library, and applications. > > The idea of interposition of a proxy DNS server as a local > fix is, if my > understanding of the problem is correct, somewhat a red > herring, by the way. > From what scant detail is available, the problem _appears_ to > be an error in > how the BIND DNS Client library uncompresses into in-memory > data structures > the compressed DNS datagrams that it has received. Assuming > this to be the > case: > > Even if the proxy DNS server has constructed the DNS datagram > that it sends to > the DNS client from scratch, as long as that datagram > contains the same > sequence of resource record sets in the same order as the > original "malicious" > DNS datagram received from the "attacking" content DNS server did, the > uncompression bug in the BIND DNS Client library will be > triggered. The > notion of "reconstructed datagrams" somehow saving the day is > therefore an > entirely misleading one. One can reconstruct the datagrams > as much as one > likes. As long as the reconstructed datagrams still contain > the exact same > data, they will be exactly the same, and they will still > trigger the BIND > uncompression bug in the same way. The thing that _actually_ > saves the day > (inasmuch as it does at all) in practical terms is that > "dnscache" does _not_ > send the same sequence of resource record sets in the same > order to DNS > clients as it received from content DNS servers in answers to > its back end > queries. "dnscache" does not send along "NS" records in the > "authority" > section and "A" records in the "additional" section (because > as far as DNS > clients are concerned, they are so much extraneous chaff). > "dnscache" sends > just the resource record sets that answer the question that > was asked by the > client. This saves the day to the extent that the DNS data > produced by an > "attacking" content DNS server, in order to exploit the BIND > DNS Client > library uncompression bug, must contain the exploit trigger > entirely within > the resource records that form the actual answer to a query, > which might turn > out to be quite difficult for an attacker to achieve. Cheers Tobias

1 0