Bug 90463

Summary: nscd uses cached reverse lookups for later forward lookups
Product: [Retired] Red Hat Linux Reporter: Norbert Warmuth <norbert.warmuth>
Component: nscdAssignee: Jakub Jelinek <jakub>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 7.3Keywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2003-12-12 08:59:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Attachments:
Description Flags
Example session 1
none
Example session 2
none
nscd configuration file
none
nsswitch.conf
none
/etc/hots none

Description Norbert Warmuth 2003-05-08 16:41:41 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030314

Description of problem:
nscd uses the result of GETHOSTBYADDR requests to answer later GETHOSTBYNAME
requests. 

An attacker might poison the nscd cache and redirect IP traffic.

See the attachments for a sample session and configuration files.


Version-Release number of selected component (if applicable):
nscd-2.2.5-43

How reproducible:
Always

Steps to Reproduce:
1. setup nameserver with a PTR RR resolving to "localhost."
2. connect to the victim host using the IP of the PTR RR
3. now the victim's nscd cache is poinsoned and traffic to the hostname
localhost will we directed to the attacher's IP


    

Additional info:

Comment 1 Norbert Warmuth 2003-05-08 16:48:26 UTC
Created attachment 91562 [details]
Example session 1

Comment 2 Norbert Warmuth 2003-05-08 16:51:25 UTC
Created attachment 91563 [details]
Example session 2

Comment 3 Norbert Warmuth 2003-05-08 16:53:24 UTC
Created attachment 91564 [details]
nscd configuration file

Comment 4 Norbert Warmuth 2003-05-08 16:59:00 UTC
Created attachment 91565 [details]
nsswitch.conf

Comment 5 Norbert Warmuth 2003-05-08 16:59:31 UTC
Created attachment 91566 [details]
/etc/hots

Comment 6 Ulrich Drepper 2003-06-04 05:51:11 UTC
This shouldn't be a problem anymore in RHL9.  Please try it.

Comment 7 Norbert Warmuth 2003-06-04 16:24:13 UTC
Verified -- RHL9 (all updates installed) does not exhibit this problem.