25 Led
2018
25 Led
'18
21:36
On Mon 2018-01-22 12:42:47 +0100, Vladimír Čunát wrote:
Knot Resolver 1.5.2 is a security release!
Security
--------
- fix CVE-2018-1000002: insufficient DNSSEC validation, allowing
attackers to deny existence of some data by forging packets.
Some combinations pointed out in RFC 6840 sections 4.1 and 4.3
were not taken into account.
Thanks for this report, Vladimír!
Out of curiosity, are there any test suites available that exercise this
particular attack? I'm trying to sort out a backported fix for the
version of knot-resolver in debian stable (1.2.0) and enough of the
codebase has changed that it's not as simple as just cherry-picking
patches f90d27de49c9d3be0424d5d5457fb18df7d5c3f3 and
d296e36eb554148f3d6f1f86e8f86ddec81de962, so i want to be sure that any
attempted change actually fixes the problem.
--dkg