Bug 1332493 (CVE-2016-10152) - CVE-2016-10152 hesiod: Use of hard-coded unsafe configuration if configuration file cannot be opened
Summary: CVE-2016-10152 hesiod: Use of hard-coded unsafe configuration if configuratio...
Alias: CVE-2016-10152
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: https://github.com/achernya/hesiod/pu...
Depends On: 1332494
Blocks: 1332511
TreeView+ depends on / blocked
Reported: 2016-05-03 10:48 UTC by Adam Mariš
Modified: 2021-02-17 03:56 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2017-01-23 01:16:50 UTC

Attachments (Terms of Use)
proposed fix (884 bytes, patch)
2016-05-03 17:16 UTC, Nalin Dahyabhai
no flags Details | Diff

Description Adam Mariš 2016-05-03 10:48:51 UTC
It was reported that hesiod uses hard-coded default domain name allowing the attacker, that can control the athena.mit.edu zone or one of its parent zones or able to pose as MITM, to supply fake Hesiod data in certain cases, allowing injection of fake root accounts. If Hesiod deployment uses DNSSEC with a trusted, validating recursive resolver to secure Hesiod data, it can result into retrieval of non-DNSSEC-signed Hesiod data, since athena.mit.edu is currently unsigned.

Vulnerable code:

#define DEF_RHS ".athena.mit.edu"
/* Try to open the configuration file. */
fp = fopen(filename, "r");
if (!fp)
/* Use compiled in default domain names. */
ctx->lhs = malloc(strlen(DEF_LHS) + 1);
ctx->rhs = malloc(strlen(DEF_RHS) + 1);

Comment 1 Adam Mariš 2016-05-03 10:49:00 UTC

Name: Florian Weimer (Red Hat)

Comment 2 Adam Mariš 2016-05-03 10:49:14 UTC
Created hesiod tracking bugs for this issue:

Affects: fedora-all [bug 1332494]

Comment 3 Florian Weimer 2016-05-03 11:28:20 UTC
glibc is not affected by this issue.  DEF_RHS has not been compiled into the library since this change:

commit 2f54c82dacba646139a773ab43fc2cdb47ee1f5b
Author: Ulrich Drepper <drepper@redhat.com>
Date:   Fri Jul 21 04:12:25 2000 +0000

        * hesiod/hesiod.c: Update from BIND 8.2.3-T5B.

Comment 4 Nalin Dahyabhai 2016-05-03 17:16:19 UTC
Created attachment 1153517 [details]
proposed fix

Comment 5 Doran Moppert 2017-01-18 02:34:05 UTC

Red Hat Product Security has rated this issue as having Low security
impact. This issue is not currently planned to be addressed in future
updates. For additional information, refer to the Issue Severity
Classification: https://access.redhat.com/security/updates/classification/.

Note You need to log in before you can comment on or make changes to this bug.