5 ms·

As far as I can tell this is a BIND bug. There are typically a dozen or so of these each year. The BIND 9 codebase (which is where this bug arose) dates back to

As far as I can tell this is a BIND bug. There are typically a dozen or so of these each year. The BIND 9 codebase (which is where this bug arose) dates back to when Bill Clinton was President of the US. Rather than "Ooh, DNSSEC is bad" the correct take is that we need to wean ourselves off ISC BIND. Maybe ISRG can pay somebody to make a less awful DNS server implementation in Rust.

quickthrower2 3y ago
The Linux codebase dates back to when George H. W. Bush was president.
- IshKebab 3y ago
  Well... security vulnerabilities in Linux are a fairly common occurrence too!
  - quickthrower2 3y ago
    How are Biden codebases doing?
    - HankB99 3y ago
      Biden caused problems with both EXT4 and ZFS.
obscurette 3y ago
It MIGHT originated from ISC, but at the moment it's the behavior standard specifies and the fix all DNS software vendors have applied, breaks the standard.
- mjevans 3y ago
  IMO every operation should have a maximum time to execute, and rejecting an update / response for failure to process fast enough SHOULD be valid, even for a an otherwise well formed packet. A protocol must be resilient to valid communications failing for arbitrary reasons including operator error or cosmic bit-flips that corrupt the transmission.
bluejekyll 3y ago
You might be interested in Hickory DNS (recently we rebranded it from Trust-DNS). The ISRG project is sponsoring work on this, announcement here: https://www.memorysafety.org/initiative/dns/ https://www.memorysafety.org/initiative/dns/
- nyrikki 3y ago
  The specification is to blame this time, not memory safety. This is one of those HALT problems that everyone likes to dismiss :)
  - bluejekyll 3y ago
    Absolutely. DNSSEC validation is expensive.
vdaea 3y ago
>The BIND 9 codebase (which is where this bug arose) dates back to when Bill Clinton was President of the US. The fact that it's that old should mean it's extremely robust.
- hsbauauvhabzb 3y ago
  Age has nothing to do with vulnerability frequency, robustness or presidency. Popularity and investment do.
taftster 3y ago
It's a little weird to me that you're dating this back to a timeline associated to a presidency. I think it just makes me feel old. Like, Bill Clinton's presidency wasn't that long ago. (was it?)
- vlovich123 3y ago
  Depends on whether you think 24 years ago is a long time ago or not.
nyrikki 3y ago
dnsmasq and unbound are impacted to https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 https://github.com/NLnetLabs/unbound/releases/tag/release-1.... https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/20... As are any other DNSSEC validators that followed the specifications. Bind9 has its problems but this is not its fault this time.
denkmoon 3y ago
Real happy powerdns user sounding off. I've only ever run it for internal dev stuff but it's great.
- xz53 3y ago
  PowerDNS got caught out too: https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6-4-9-3-5-0-2-released https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6...
tsimionescu 3y ago
The researchers and other DNS server maintainers explicitly say this is a bug in the DNSSEC standard, and technically all patched servers are now standard-incompliant.

quickthrower2 3y ago

The Linux codebase dates back to when George H. W. Bush was president.

IshKebab 3y ago
Well... security vulnerabilities in Linux are a fairly common occurrence too!
- quickthrower2 3y ago
  How are Biden codebases doing?
  - HankB99 3y ago
    Biden caused problems with both EXT4 and ZFS.

obscurette 3y ago

It MIGHT originated from ISC, but at the moment it's the behavior standard specifies and the fix all DNS software vendors have applied, breaks the standard.

mjevans 3y ago
IMO every operation should have a maximum time to execute, and rejecting an update / response for failure to process fast enough SHOULD be valid, even for a an otherwise well formed packet. A protocol must be resilient to valid communications failing for arbitrary reasons including operator error or cosmic bit-flips that corrupt the transmission.

bluejekyll 3y ago

You might be interested in Hickory DNS (recently we rebranded it from Trust-DNS). The ISRG project is sponsoring work on this, announcement here: https://www.memorysafety.org/initiative/dns/ https://www.memorysafety.org/initiative/dns/

nyrikki 3y ago
The specification is to blame this time, not memory safety. This is one of those HALT problems that everyone likes to dismiss :)
- bluejekyll 3y ago
  Absolutely. DNSSEC validation is expensive.

vdaea 3y ago

>The BIND 9 codebase (which is where this bug arose) dates back to when Bill Clinton was President of the US. The fact that it's that old should mean it's extremely robust.

hsbauauvhabzb 3y ago
Age has nothing to do with vulnerability frequency, robustness or presidency. Popularity and investment do.

taftster 3y ago

It's a little weird to me that you're dating this back to a timeline associated to a presidency. I think it just makes me feel old. Like, Bill Clinton's presidency wasn't that long ago. (was it?)

vlovich123 3y ago
Depends on whether you think 24 years ago is a long time ago or not.

nyrikki 3y ago

dnsmasq and unbound are impacted to https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.1 https://github.com/NLnetLabs/unbound/releases/tag/release-1.... https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/20... As are any other DNSSEC validators that followed the specifications. Bind9 has its problems but this is not its fault this time.

denkmoon 3y ago

Real happy powerdns user sounding off. I've only ever run it for internal dev stuff but it's great.

xz53 3y ago
PowerDNS got caught out too: https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6-4-9-3-5-0-2-released https://blog.powerdns.com/2024/02/13/powerdns-recursor-4-8-6...

tsimionescu 3y ago

The researchers and other DNS server maintainers explicitly say this is a bug in the DNSSEC standard, and technically all patched servers are now standard-incompliant.