openwrtv3/package/network
Kevin Darbyshire-Bryant a3198061f8 dnsmasq: backport dnssec security fix
CVE-2017-15107

An interesting problem has turned up in DNSSEC validation. It turns out
that NSEC records expanded from wildcards are allowed, so a domain can
include an NSEC record for *.example.org and an actual query reply could
expand that to anything in example.org  and still have it signed by the
signature for the wildcard. So, for example

!.example.org NSEC zz.example.org

is fine.

The problem is that most implementers (your author included, but also
the Google public DNS people, powerdns and Unbound) then took that
record to prove the nothing exists between !.example.org and
zz.example.org, whereas in fact it only provides that proof between
*.example.org and zz.example.org.

This gives an attacker a way to prove that anything between
!.example.org and *.example.org doesn't exists, when it may well do so.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
2018-01-19 22:11:16 +01:00
..
config treewide: fix build depends to refer to source package names 2018-01-13 19:54:44 +01:00
ipv6 odhcp6c: add sendopts config support and update to latest git HEAD 2018-01-18 11:39:42 +01:00
services dnsmasq: backport dnssec security fix 2018-01-19 22:11:16 +01:00
utils xtables-addons: remove from base 2018-01-16 19:40:29 +01:00