Re: FWD: CVE-request: systemd-resolved DNS cache poisoning

["Dimitrios Chr. Ioannidis" <d.ioannidis@nephelae.eu>]

On 12-11-2014 18:22, Martinx - ジェームズ wrote:
> Guys,
>
> This worth to be read:
>
> http://seclists.org/oss-sec/2014/q4/592
>
> Best,
> Thiago


IMHO, the answer is more interesting .

QUOTE :

"BIND 9 is supposed to filter such garbage from upstream answers, but 
there are other resolvers out there which will pass through such answers 
unchanged, so this is very much CVE-worthy.


(This systemd component is optional, I strongly recommend not to ship 
it. It's not even possible right now to dump the cache contents to debug 
such issues.)


--
Florian Weimer / Red Hat Product Security"


Regards,
--
Dimitrios Chr. Ioannidis