| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 22 Oct 2007 20:05:06 +0200 From: "Collin R. Mulliner" <collin@...aversion.net> To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com Subject: simple dns rebinding protection with dnsmasq dnsmasq (http://www.thekelleys.org.uk/dnsmasq/doc.html) a popular DHCP and DNS forwarder and cache server used on many DSL/Cable routers now has a simple DNS Rebinding protection mechanism. When executed with the --stop-dns-rebind option the DNS resolver in dnsmasq will filter out private IP addresses (127.0.0.0/8, 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12 and 169.254.0.0/16). This should be sufficient for most private/home users. Feedback welcome. dnsmasq: http://www.thekelleys.org.uk/dnsmasq/doc.html dnsmasq with dns rebinding protection: http://www.thekelleys.org.uk/dnsmasq/test-releases/dnsmasq-2.41test11.tar.gz orginal patch: http://www.mulliner.org/blog/blosxom.cgi/security/dnsmasq_dnsrebinding_protection_patch.html Collin -- Collin R. Mulliner <collin@...aversion.net> BETAVERSiON Systems [www.betaversion.net] info/pgp: finger collin@...aversion.net weblog: http://www.mulliner.org/blog/ Tabs are for indentation space is for astronauts. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists