<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>
<div>Thanks, Brian. Was getting ready to reach out to internal contacts to respond more authoritatively. That's what I inadequately expressed as the "unknown unknown" -- while trying to get customers info quickly (actually, not just trying, customers demand
it -- understandably) the rules of the game were changing. Glad to see you on-list.</div>
</div>
</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>"Brian Hartvigsen (bhartvig)" <<a href="mailto:bhartvig@cisco.com">bhartvig@cisco.com</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, February 23, 2016 at 2:27 PM<br>
<span style="font-weight:bold">To: </span>Damian Menscher <<a href="mailto:damian@google.com">damian@google.com</a>><br>
<span style="font-weight:bold">Cc: </span>michoski <<a href="mailto:michoski@cisco.com">michoski@cisco.com</a>>, "<a href="mailto:dns-operations@dns-oarc.net">dns-operations@dns-oarc.net</a>" <<a href="mailto:dns-operations@dns-oarc.net">dns-operations@dns-oarc.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [dns-operations] CVE-2015-7547: glibc getaddrinfo buffer overflow<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
I actually wrote the blog post and tried to be very specific in what I wrote. The claim was that we could protect from the malformed DNS packets put forward in the PoC code. Which is accurate and the best information we had to go on at the time. Further
updates have come out now that say the vulnerability is exploitable with properly constructed DNS packets. That’s a whole different ball game (as discussed in this thread and many others like it.)
<div class=""><br class="">
</div>
<div class="">I’ll see what can be done to put a disclaimer on that article that new information means that we may not offer the protection once thought. (For me this is also an issue with the disclosure, we want to protect people from being exploited obviously,
but the initial posting didn’t give a ton of information on what an actual attack could/would look like. A couple people at OpenDNS reached out to contacts at RedHat and were unable to get any additional information aside from what was in the Google article.)</div>
<div class=""><br class="">
</div>
<div class="">Anyway...</div>
<div class=""><br class="">
</div>
<div class="">— Brian</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<div class="">
<div>
<blockquote type="cite" class="">
<div class="">On Feb 23, 2016, at 11:20 AM, Damian Menscher <<a href="mailto:damian@google.com" class="">damian@google.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">
<div class="gmail_extra">
<div class="gmail_quote">On Tue, Feb 23, 2016 at 10:01 AM, Mike Hoskins (michoski)
<span dir="ltr" class=""><<a href="mailto:michoski@cisco.com" target="_blank" class="">michoski@cisco.com</a>></span> wrote:<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div id=":4mn" class="a3s" style="overflow:hidden">Just in case anyone's wondering, OpenDNS isn't affected.<br class="">
<br class="">
<a href="https://engineering.opendns.com/2016/02/17/2980/" rel="noreferrer" target="_blank" class="">https://engineering.opendns.com/2016/02/17/2980/</a></div>
</blockquote>
</div>
<br class="">
They're not directly vulnerable, but their claim that they protect their users is a bit over-stated -- all RFC-compliant DNS servers provide the same protections (not forwarding packets that don't follow the DNS spec). The problem is that there *might* be
a way to exploit this via RFC-compliant DNS packets (I'm personally not convinced, but nobody wants to claim it's impossible). And that would get past their defenses (and everyone else's).</div>
<div class="gmail_extra"><br class="">
</div>
<div class="gmail_extra">Additionally, anyone using a remote resolver is vulnerable to a MitM injecting a malicious response, so everyone should upgrade. Claims that OpenDNS users "aren't affected" are misleading and dangerous.</div>
<div class="gmail_extra"><br class="">
</div>
<div class="gmail_extra">Damian</div>
</div>
_______________________________________________<br class="">
dns-operations mailing list<br class="">
<a href="mailto:dns-operations@lists.dns-oarc.net" class="">dns-operations@lists.dns-oarc.net</a><br class="">
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br class="">
dns-jobs mailing list<br class="">
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-jobs">https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</a></div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</div>
</span>
</body>
</html>