Bug 488594 - dkim-milter: DNS public key DoS
dkim-milter: DNS public key DoS
Status: CLOSED CURRENTRELEASE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,source=osssecurity,re...
: Security
Depends On: 488595
Blocks:
  Show dependency treegraph
 
Reported: 2009-03-04 16:16 EST by Vincent Danen
Modified: 2009-03-21 21:13 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-03-21 21:13:32 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Upstream patch to fix the issue (4.75 KB, patch)
2009-03-04 16:17 EST, Vincent Danen
no flags Details | Diff

  None (edit)
Description Vincent Danen 2009-03-04 16:16:42 EST
dkim-milter does not properly handle verification of messages signed with a key that has been revoked in DNS (the p= flag set to an empty string).

References:

http://www.openwall.com/lists/oss-security/2009/03/01/1
http://sourceforge.net/tracker/index.php?func=detail&aid=2508602&group_id=139420&atid=744358
http://www.debian.org/security/2009/dsa-1728

A CVE has been requested, but not assigned yet.

This has been fixed upstream in 2.8.1, which is shipped in F10, but F9 has 2.5.1 which would be vulnerable to this issue.
Comment 1 Vincent Danen 2009-03-04 16:16:57 EST
Created dkim-milter tracking bugs for this issue

Affects: F9 [bug #488595]
Comment 2 Vincent Danen 2009-03-04 16:17:36 EST
Created attachment 334070 [details]
Upstream patch to fix the issue
Comment 3 Fedora Update System 2009-03-04 18:27:23 EST
dkim-milter-2.8.1-1.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/dkim-milter-2.8.1-1.fc9
Comment 4 Fedora Update System 2009-03-05 11:26:53 EST
dkim-milter-2.8.1-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.