oss-sec mailing list archives



CVE-request: systemd-resolved DNS cache poisoning

Hi systemd-resolved contains a caching resolver, which has to be enabled via /etc/nsswitch.conf in order to be integrated. Any local name resolvings via getaddrinfo() etc. are then routed via DBUS to systemd-resolved which resolves the name and caches it according to TTL from the answer. However, systemd-resolved does not implement any of the hardening recommendations of rfc5452. At its simplest, an attacker triggers a query to a domain he controls via SMTP or SSH-login. Upon receipt of the question, he can just add any answer he wants to have cached to the legit answer he provides for the query, e.g. providing two anser RR's: One for the question asked and one for a question that has never been asked - even if the DNS server is not authoritative for this domain. The attacker would need to guess the source port of the origin since he only sees the query from victims upstream DNS, but since systemd-resolved also uses fix source ports, thats easy. systemd-resolved creates cache entries soley from what is provided in the DNS replies. This issue has already been reported to upstream. Thanks to Santa L. Helper for private discussion. Sebastian -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer () suse de - SuSE Security Team

By Date By Thread

Current thread: