full-disclosure - Re: simple dns rebinding protection with dnsmasq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 23 Oct 2007 09:59:48 +0200
From: "Guasconi Vincent" <tyoptyop@...il.com>
To: "Collin R. Mulliner" <collin@...aversion.net>, 
	full-disclosure@...ts.grok.org.uk
Subject: Re: simple dns rebinding protection with dnsmasq

On 10/22/07, Collin R. Mulliner <collin@...aversion.net> wrote:
> dnsmasq (http://www.thekelleys.org.uk/dnsmasq/doc.html) a popular DHCP
> and DNS forwarder and cache server used on many DSL/Cable routers now
> has a simple DNS Rebinding protection mechanism. When executed with the
> --stop-dns-rebind option the DNS resolver in dnsmasq will filter out
> private IP addresses (127.0.0.0/8, 192.168.0.0/16, 10.0.0.0/8,
> 172.16.0.0/12 and 169.254.0.0/16). This should be sufficient for most
> private/home users.
>
> Feedback welcome.
>
>
> dnsmasq:
> http://www.thekelleys.org.uk/dnsmasq/doc.html
>
>
> dnsmasq with dns rebinding protection:
> http://www.thekelleys.org.uk/dnsmasq/test-releases/dnsmasq-2.41test11.tar.gz
>
> orginal patch:
> http://www.mulliner.org/blog/blosxom.cgi/security/dnsmasq_dnsrebinding_protection_patch.html
>

DNS Spoofing problems... aren't in DNS.
Nevermind thanks for the fix, it's a good idea, and going to help anyway.

I hope Adobe (and some others) hear you. (^-^)

-- 
Guasconi Vincent
Etudiant.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/