[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] CVE for the TSIG issue in knot?
From:       Solar Designer <solar () openwall ! com>
Date:       2017-06-24 12:28:20
Message-ID: 20170624122820.GB29096 () openwall ! com
[Download RAW message or body]

On Sat, Jun 24, 2017 at 01:58:23PM +0200, Yves-Alexis Perez wrote:
> I noticed the recent issue in knot with TSIG bypass
> (https://lists.nic.cz/pipermail/knot-dns-users/2017-June/001144.html)

Is is inappropriate to post only a link in here.  In cases like this,
please also quote at least the most essential portion of the content
you're referring to, which is:

"CZ.NIC has released Knot DNS 2.5.2 and Knot DNS 2.4.5. Beside several fixes and improvements,
these versions fix a flaw within the TSIG protocol implementation that would allow an attacker
with a valid key name and algorithm to bypass the TSIG authentication if no additional ACL
restrictions is set. This vulnerability was discovered by security experts from Synacktiv.
Special thanks to them!"

Alexander
[prev in list] [next in list] [prev in thread] [next in thread]