Bug 132349 - dns/djbdns (PATCH) dns/djbdns authority poisoning
Summary: dns/djbdns (PATCH) dns/djbdns authority poisoning
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: Peter Pentchev
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-03-05 23:20 UTC by hg
Modified: 2009-03-06 16:30 UTC (History)
0 users

See Also:

Attachments
file.shar (928 bytes, text/plain)
2009-03-05 23:20 UTC, hg 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description hg 2009-03-05 23:20:02 UTC 
	
Dempsky reports and DJB confirms authority poisoning vulnerability in 
some tinydns/axfrdns configurations.  See for ex.
http://article.gmane.org/gmane.comp.security.bugtraq/39157


Maintainer, please update.  Thanks!

How-To-Repeat: 	

See Dempsky's bugtraq email
Comment 1 Edwin Groothuis freebsd_committer freebsd_triage 2009-03-05 23:20:12 UTC 
Responsible Changed
From-To: freebsd-ports-bugs->roam

Over to maintainer (via the GNATS Auto Assign Tool)
Comment 2 dfilter service freebsd_committer freebsd_triage 2009-03-06 16:20:26 UTC 
roam        2009-03-06 16:20:17 UTC

  FreeBSD ports repository

  Modified files:
    dns/djbdns           Makefile 
  Added files:
    dns/djbdns/files     patch-response.c 
  Log:
  Fix the AXFR subdomain overwrite vulnerability discovered by
  Matthew Dempsky.  Also, fix the quoting of the BROKEN messages.
  
  PR:             132366, 132349
  Submitted by:   Renato Botelho <garga@FreeBSD.org>,
                  Howard Goldstein <hg@queue.to>
  
  Revision  Changes    Path
  1.34      +3 -3      ports/dns/djbdns/Makefile
  1.1       +11 -0     ports/dns/djbdns/files/patch-response.c (new)
_______________________________________________
cvs-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/cvs-all
To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
Comment 3 Peter Pentchev freebsd_committer freebsd_triage 2009-03-06 16:20:56 UTC 
State Changed
From-To: open->closed

I've just committed a very similar patch.  Thanks!