Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security IT

Dan Bernstein Confirms Security Flaw In Djbdns 66

Posted by timothy from the gets-yer-money-and-takes-yer-chances dept.
secmartin writes "Dan Bernstein has just admitted that a security issue has been found in the djbdns software, one of most popular alternatives for the BIND nameserver. As part of the djbdns security guarantee, $1000 will be paid to Matthew Dempsky, the researcher that found the bug. The bug allows a nameserver running djbdns to be poisoned using just a single packet. Other researchers have found a separate issue that allows dnscache, the DNS cache that is also part of the djbdns package, to be poisoned within just 18 minutes when using the default configuration. Anyone using djbdns is strongly encouraged to patch their servers immediately." Reader emad contributes a link to the djbdns mailing list post containing both a patch and a sample exploit, and adds: "In the words of Dan Kaminsky (of recent DNS security fame): 'However, Dempsky's bug in djb's tinydns is way more surprising, if only because ... holy crap, he pulled an exploitable scenario out of THAT?!'"
This discussion has been archived. No new comments can be posted.

Dan Bernstein Confirms Security Flaw In Djbdns More

Dan Bernstein Confirms Security Flaw In Djbdns

Comments Filter:

  • Do not use for anything important (Score:5, Funny)

    by Wonko the Sane ( 25252 ) * on Thursday March 05, 2009 @04:01PM (#27082373) Journal

    Why would anyone trust critical internet infrastructure to a piece of software that averages a security flaw every decade?

    Real admins stick to a proven solution such as Bind.

    • *laugh* Yes, such a low security flaw rate is highly suspicious, and worse yet doesn't create enough work for admins! Bind is much, much better in this regard.

    • Real admins stick to a proven solution such as Bind.

      Yep. We like getting paid. ;)

  • Hell must have frozen over (Score:5, Interesting)

    by MichaelSmith ( 789609 ) on Thursday March 05, 2009 @04:03PM (#27082419) Homepage Journal
    DBJ admitted to a bug.

    I run qmail by the way. DJB writes good stable software but I get the impression he is not a good listener.

    • DJB writes good stable software but I get the impression he is not a good listener.

      Agreed. I have issues with his 'fuck what the rest of the community does, it's my way or the high way' mentality. One of the reasons I opted for MaraDNS instead of djbdns at one of our smaller sites.

      • 'fuck what the rest of the [world] does, it's my way or the high way'

        Why does that attitude seem so familiar? There was a guy with that attitude I'd heard about once before...S....t....uart? No....S...t..an? No......S...t...e...

        Aw, hell, I can't think of it. Anyhow, last name started with 'J'.

      • Re: (Score:3, Funny)

        by Randle_Revar ( 229304 )

        I recently saw a blog post contemplating what it would be like if Jorg Schilling (cdrtools/cdrecord) got in an argument with Daniel Bernstein.

        I figure for real entertainment, add in ESR, the XFree86 guys and Tuomov (Ion WM)

      • Well actually, in this case, he seems to be having a better attitude; he's confirmed that there is a real issue, and even links to Dempsky's patch. So there appears to be some improvement here, which was one of the reasons I submitted this to slashdot!

      • Re: (Score:2)

        by gweihir ( 88907 )

        Me too. DJBs documentation and configuration approach is also highly confusing. I have run Qmail for 4 years now on what used to be my main machine. When it runs, it runs fine, but it was a real adventure getting there. For new intallations I now use Postfix. Far, far less obscure to configure.

        The oder problem with DJBs software that actually broke thing, is his ideas about time handling. I had to drop his ntp software because of that.

        My bottom line is that with regard to security and stability DJBs stuff i

    • He's a collage professor. If he "listened" his head would explode from all the bad information he receives from young college students that think they know everything.

      It's survival instinct to stop listening once you become a teacher, otherwise the results could be catastrophic. The teacher could become aware that all the students are idiots that make garden snails look like PhD candidates and attempt mass murder of the student body.

      News Flash: Teacher listens to students and climbs bell tower with high pow

      • collage professor

        young college students

        Tee hee =p

        • Re: (Score:1)

          by timothy ( 36799 ) Works for Slashdot

          In my sister's college application essays (one of them, at least), she outlined her reasons for wanting to attend a "four-year collage." Will always make me chuckle.

          (But then, my brother teased me for years for pronouncing "pier" identically to "pyre.")

          timothy

      • Re: (Score:2)

        by Pope ( 17780 )

        collage professor

        Damn art school know it alls!

  • Yay! (Score:2, Interesting)

    by Anonymous Coward

    DJBDNS now has 1/3 as many exploits as OpenBSD for the past decade+.

    How's Microsoft doing on that front?

    Oh wait.

    • To be fair, Windows is probably proportionally about as much larger than (the default install of) OpenBSD as OpenBSD is than DJBDNS.

      So you ought to allow Windows about 9 vulnerabilities in that time ;-)

      Seriously though, I wonder what sort of rate expected number of vulnerabilities should increase with respect to size of a codebase, given somehow equivalent levels of "correctness". Intuitively, i suspect it'd be at least O(size^2), if not much, much faster.

  • Finding a security flaw in anything Dan Bernstein writes is definitely worthy of being on the front page, even if almost everybody uses Bind instead.

  • oh, _that_'s the bug? (Score:5, Insightful)

    by Onymous Coward ( 97719 ) on Thursday March 05, 2009 @05:45PM (#27084021) Homepage

    Since I'm one of the admins who's enjoyed having an vulnerability-free djbdns installation for years, I thought I'd look more into the vuln.

    Say what you will about DJB, other than being seemingly ornery he appears to be forthright and focused on correctness. In under a week he confirms the vuln and posts a patch and awards the security guarantee money. This is the kind of behavior I want from the people who build my software. http://article.gmane.org/gmane.network.djbdns/13864 [gmane.org]

    Here's the bug:

    If the administrator of example.com publishes the example.com DNS data
    through tinydns and axfrdns, and includes data for sub.example.com
    transferred from an untrusted third party, then that third party can
    control cache entries for example.com, not just sub.example.com.

    How many of you are running domains like this? It's not something I need to bother patching for. Ah, I guess that's another great thing about the relative rarity of bugs. If one is found it's less likely to be relevant for your particular situation.

    The article submitter says:

    "Anyone using djbdns is strongly encouraged to patch their servers immediately."

    I think "anyone" is a bit strong here.

    • what about the man's attitude? (Score:5, Insightful)

      by Onymous Coward ( 97719 ) on Thursday March 05, 2009 @05:52PM (#27084125) Homepage

      I just realized this:

      The next release of djbdns will be backed by a new security guarantee.
      In the meantime, if any users are in the situation described above,
      those users are advised to apply Dempsky's patch and requested to accept
      my apologies.

      He's apologizing. How's that for forthright behavior? He's not being evasive. He's not pointing fingers. He's owning up to personal error, and expressing what appears to be compunction. For one bug in a decade.

      Yeah, tell me how you don't like his attitude. I think it's fine.

      Mr. Bernstein, good work I say. Thank you very much for your efforts and skill and honesty.

      • Re: (Score:3, Informative)

        by myowntrueself ( 607117 )

        Well yeah, I am amazed!

        When someone (Fyodor iirc) found an exploit in qmail way back, Dan was in complete denial and was quite disingenuous about the whole thing.

        • (George Guninski.)

          As I'm very interested in knowing the truth of claims regarding Bernstein's misbehavior, it would help me very much if you could point to specific quotes or actions of his that show "complete denial" and being "disingenuous". Thanks!

          • Have a look at the article, there's a short summary about the qmail issue. In short, there was a security issue, but because it can only be exploited if qmail was assigned gigabytes of memory (the bug involved a 32-bit memory address), DJB didn't think it was an actual issue.

            To quote: Nobody gives gigabytes of memory to each qmail-smtpd process, so there is no problem with qmailâ(TM)s assumption that allocated array lengths fit comfortably into 32 bits.

            • Oh, that's what you mean by "complete denial". I thought you meant denial as in

              Denial is a defense mechanism postulated by Sigmund Freud, in which a person is faced with a fact that is too uncomfortable to accept and rejects it instead, insisting that it is not true despite what may be overwhelming evidence.

              I didn't realize you meant it in the simple sense of "to state that something is not true".

              But maybe you actually do mean the defense mechanism version? I guess then that there would have to be overwhelming evidence. Do you see it as likely or possible that qpopd would be given 4 GB of (even virtual) memory? I'm not familiar with how it's normally run. Anyone?

              What about the disingenuous part? Is that also for denying the fe

            • I agree with DJB. If you worked for me and setup qmail with gigs of memory for each qmail-smptd, I'd fire you. That's an intentional mis-config, not to mention bad practice.

          • A simple Google search for Fyodor qmail exploit should do it. Its not hard to find references to.

            • George Guninski, I'll say again.

              I'm pretty sure that's the exploit in question. If you disagree, could you link please?

      • Yep, most of what you hear about DJB is nothing more than internet myth and/or people who can't disagree without getting angry.

      • Re: (Score:1, Insightful)

        by Anonymous Coward
        He's ponying up a thousand dollars, that tells you all you need to know. The closed-source providers make millions from their software, yet how much do they pay out to bug-finders? Bugger all!

    • Re: (Score:2)

      by rthille ( 8526 )

      I have to agree there, as a user of tinydns/dnscache, this bug doesn't affect me because I don't let other people serve their records from my install of DJBDNS. If I did, I'd likely ask them for a 'data' file, look it over manually and manually install it. yeah it's more of a PITA than AXFR, but for my needs it is fine.

      Even the other bug with the 200 outstanding requests for a record would be problematic to exploit on my network, since I only allow trusted computers on my network and you have to be on my

    • You make it sound like this is the rarest thing in the world. It a solid and substantial vulnerability.

      Maybe you don't have any third party controlled sub-domains but I assure you it is actually quite common.

      • You make it sound like this is the rarest thing in the world. It a solid and substantial vulnerability.

        I don't mean to make it sound like the "rarest thing in the world". But I wouldn't expect maybe a single Slashdotter to be in this position. Otherwise, please note my comment here [slashdot.org].

        • 'But I wouldn't expect maybe a single Slashdotter to be in this position.'

          Sub-domain hosting is actually a fairly common thing. If I used tinydns I'd be at risk for this vulnerability now.

  • First of all, I really like djbdns! Up until two weeks ago I ran it for our my employer (700~ tlds) and it had been running flawless for the last 4 years.

    The reason, in the end, for the switch is due to the administrative workload of using djbdns.

    Pushing updates to other servers usually involves pushing the .cdb data file to the dns/root directory of each of the resolves. Ok one chore, fine. The problem is in managing the database.

    Managing 50-100 records command line is feasible, but if you have a lot of do

    • I had to check to make sure you weren't my old boss! A place I worked about a year ago did that. Our systems automatically registered hosted domain names and dropped the list of subdomains into our database. A cron job pulled records from there, generated the data file, compiled it and told tinydns to reload it.

      I really appreciated djbdns's data format after having dealt with BIND at my last job. I remember it being disturbingly finicky about its input--there are plenty of ways to kill your DNS server if, f

Slashdot Top Deals

"The whole problem with the world is that fools and fanatics are always so certain of themselves, but wiser people so full of doubts." -- Bertrand Russell

Close