It was reported that hesiod uses hard-coded default domain name allowing the attacker, that can control the athena.mit.edu zone or one of its parent zones or able to pose as MITM, to supply fake Hesiod data in certain cases, allowing injection of fake root accounts. If Hesiod deployment uses DNSSEC with a trusted, validating recursive resolver to secure Hesiod data, it can result into retrieval of non-DNSSEC-signed Hesiod data, since athena.mit.edu is currently unsigned.
#define DEF_RHS ".athena.mit.edu"
/* Try to open the configuration file. */
fp = fopen(filename, "r");
/* Use compiled in default domain names. */
ctx->lhs = malloc(strlen(DEF_LHS) + 1);
ctx->rhs = malloc(strlen(DEF_RHS) + 1);
Name: Florian Weimer (Red Hat)
Created hesiod tracking bugs for this issue:
Affects: fedora-all [bug 1332494]
glibc is not affected by this issue. DEF_RHS has not been compiled into the library since this change:
Author: Ulrich Drepper <firstname.lastname@example.org>
Date: Fri Jul 21 04:12:25 2000 +0000
* hesiod/hesiod.c: Update from BIND 8.2.3-T5B.
Created attachment 1153517 [details]
Red Hat Product Security has rated this issue as having Low security
impact. This issue is not currently planned to be addressed in future
updates. For additional information, refer to the Issue Severity