--nextPart5655249.hHqDaP3eae
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200901-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: pdnsd: Denial of Service and cache poisoning
      Date: January 11, 2009
      Bugs: #231285
        ID: 200901-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Two errors in pdnsd allow for Denial of Service and cache poisoning.

Background
==========

pdnsd is a proxy DNS server with permanent caching that is designed to
cope with unreachable DNS servers.

Affected packages
=================

    -------------------------------------------------------------------
     Package        /  Vulnerable  /                        Unaffected
    -------------------------------------------------------------------
  1  net-dns/pdnsd       < 1.2.7                              >= 1.2.7

Description
===========

Two issues have been reported in pdnsd:

* The p_exec_query() function in src/dns_query.c does not properly
  handle many entries in the answer section of a DNS reply, related to
  a "dangling pointer bug" (CVE-2008-4194).

* The default value for query_port_start was set to 0, disabling UDP
  source port randomization for outgoing queries (CVE-2008-1447).

Impact
======

An attacker could exploit the second weakness to poison the cache of
pdnsd and thus spoof DNS traffic, which could e.g. lead to the
redirection of web or mail traffic to malicious sites. The first issue
can be exploited by enticing pdnsd to send a query to a malicious DNS
server, or using the port randomization weakness, and might lead to a
Denial of Service.

Workaround
==========

Port randomization can be enabled by setting the "query_port_start"
option to 1024 which would resolve the CVE-2008-1447 issue.

Resolution
==========

All pdnsd users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-dns/pdnsd-1.2.7"

References
==========

  [ 1 ] CVE-2008-1447
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447
  [ 2 ] CVE-2008-4194
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4194

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200901-03.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2009 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

--nextPart5655249.hHqDaP3eae
Content-Type: application/pgp-signature; name=signature.asc 
Content-Description: This is a digitally signed message part.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iQIcBAABAgAGBQJJaUA+AAoJECaaHo/OfoM5b9AP/ixF7Vf4iXyDrbuAUogBq6Vk
JKdMxVZIDIaWzTVL8vxnddcE8/tuz9A+8zX9KzGUxXxwKSoke5ozlZ9KJeljlWs2
NVh8bSwnIuiRCRpoVbBU1xDKugg961Ex6WI0D0Cfqx8XKK+ZNm4YfSrOGIoUksoy
QP6VgRvb2LfiIX/c7lELPTC+3ZhI4ingyyqJba9KVsQkRWGlDpVuY2s8mGLhd21f
sViSrQqWRaAGzkLNYkG55lkRINUBlPwoPiTLmOdwO/J3RD6jev/nLomWnOWbuW1f
4MhNUGa+MilvBW5cR7tRevZrfBfrYU3l7e95pxmee2z7IVtVOl+N8FL7yvE2Mr5V
JnN64GJRoscLDDd1JcR0GGbVt/NSmIiPd3x08sLytukX+ZW1Xg0UtDV1H5/gYZUQ
x84cEnwhooIPd8oHYJa1uVrHk5ws3nUdqyE1cQLHqyn5B6bl3eUczAL+NCI02bNp
hHXWwiX9t/h+GbgbdNHtyfWNJFER1v5YPWb9Y2jtHKkPpa6CAifYiEs1SHTnxkLB
CmdmcXVzLIAhTESe04u/dakmA5ljWfC7fU0Up6zy8/FdsC1qL5MB354ouSRiswT6
0ZrHdSoqI09dt9xA81knGThdNtZH3KXCwy+KCLk8wruXx1q7tiALHQstpJHkZ1Ke
5DipHJGHu1uW9yerPW3H
=liaq
-----END PGP SIGNATURE-----

--nextPart5655249.hHqDaP3eae--