3 ms·
This affects 2008 and newer, older versions did not support DNAME[1] records. It isn't clear whether an existing DNAME record needs to exist in order for this t
by hdmoore 11y ago
This affects 2008 and newer, older versions did not support DNAME[1] records. It isn't clear whether an existing DNAME record needs to exist in order for this to be exploitable. Skimming the Sonar FDNS[2] dataset, only 5,581 DNAME records were identified[3]. A diff has been posted by Greg Linares[4], showing the addition of a memset(0) to the DNAME merge function.
1. https://tools.ietf.org/html/rfc6672 https://tools.ietf.org/html/rfc6672
2. https://scans.io/study/sonar.fdns https://scans.io/study/sonar.fdns
3. https://hdm.io/data/20151121_dname.txt.gz https://hdm.io/data/20151121_dname.txt.gz
4. https://twitter.com/Laughing_Mantis/status/674308454379425792 https://twitter.com/Laughing_Mantis/status/67430845437942579...
- dsp1234 11y agoIt looks like there are multiple UAF patches (of which DNAME is one). The bigger problem appears to be the UAF in Recurse_ProcessResponse[0], which implies it may be more than just DNAME records. [0] - https://twitter.com/Laughing_Mantis/status/674294695736967169 https://twitter.com/Laughing_Mantis/status/67429469573696716...
- rb12345 11y agoThe older versions are out of support though, aren't they? It's possible that variants of this might exist in those too if the sibling comment is correct.
- KirinDave 11y agoYes, but there's only so much anyone can reasonably be expected to do if someone doesn't update their computer for 7 years, I suppose.