CVE-2017-9445: systemd Hit By New Security Vulnerability

[Naib]

It's incredibly disingenuous articles like this that morally prevent me from obtaining another subscription to Phoronix. You know it's a soft topic, choose your words more carefully. From a first perspective, even I thought it was a vulnerability that crashed the systemd daemon, not systemd-resolve. There's a clear difference there. I know you're not stupid and I'm quite aware that you made the article for click bait. Michael

If you can't control your emotions, don't expect others to control their phrasing to mitigate your shortcomings

can you link to that prediction? it might be a good read.

https://lists.dns-oarc.net/pipermail...ne/014964.html

systemd-resolved requires a forwarder. It is not a full DNS recursive server. So source port randomization is pretty useless as you are most likely just doing DNS on the local network. Also, "improve resilience against cache poisoning" is quite the weasel wording. Especially since it trusts faster answers over slower ones over different interfaces. The design is still horribly broken. At devconf, the systemd people described the system to us. Things might have changed since then and we should verify that. With that, let me mention what I remember: - It uses nsswitch to basically take over gethostbyname*() and getaddrinfo(). This means any software using a DNS library like ldns, unbound, bind, knot, etc bypasses this system and gets an inconsistent DNS view from the rest of the system. It explictely does not support those kind of applications. Due to its issues below, this is a problem for applications insisting on DNSSEC answers (eg postfix). It does not supply a "local DNS server" that those dns libraries could use to get a consistent view. - it fudges with /etc/resolv.conf, but it does not provide a DNS server. So it cannot put 127.0.0.1 in resolv.conf. This means ANY application using /etc/resolv.conf that does not use glibc is going to go around systemd-resolvd. Yet systemd-resolvd messes with resolv.conf. - The process turns a request for binary DNS data into into XML, feeds it into the sytemd/dus ecosystem, which turns it into binary DNS to send it to the forwarder. The binary DNS answer then gets turned into XML goes through systemd/dbus, then is turned back into binary DNS to feed back into glibc. Apart from errors in this process, like last year's CVE on cache poisoning attacks, this means the systemd people need to very actively maintain their code whenever a new feature or RRTYPE is added to the DNS protocol. Maintenance and bugfixes is not systemd's strong point. This architecture is overly complex and unneccessary. - It won't work well with applications that have their own DNS code itside. Such as browsers. This becomes worse when you think about browsers supporting draft-shore-tls-dnssec-chain-extension. - It is yet another program/daemon that runs races with other software in controlling /etc/resolv.conf. Eg VPN software adding nameservers. - There is no option to become a full recursive DNS server. It depends on a forwarder being obtained via DHCP. This means any broken forwarder leads to a broken setup. eg an upstream that strips DNSSEC. - It accepts DNS forwarders for all its interfaces. That means if you are on wifi and 3g, or ethernet and wifi, you have more than one DNS server from logically different networks. With no way of guaranteeing which logical network you asking. - It sends out a DNS queries over all its obtained DNS servers all the time. This means DNS queries for split-DNS view resources leak all over the internet. - It accepts the first valid answer. This could be an unsigned answer. This means a local attacker (eg wifi hotspot) has an advantage over the actual real DNS forwarders. - It prefers an answer over an NXDOMAIN as workaround for the above. So if some A record does not exist, the NXDOMAIN is ignored in favour of a forged, or rogue wildcard type, answer. - It does not implement RFC-5011 properly. It might remove trusted keys upon seeing the revoke bit instead of waiting the time period specified in RFC-5011. - I believe it does not support DNS-over-TLS - I _believe_ it does not support network changes that requre a cache flush, for instance a VPN network with an internal *.corp.company.com whose entries need to be removed from the cache when the network is lost. - I _believe_ it does not handle trust anchors linked to DNS nameserver IP addreses. Needed for DHCP servers relaying multiple domain names for resolving and VPN situations like draft-pauly-ipsecme-split-dns-01 - I _believe_ it will not able to reconfigure forwarders on the fly. I was told it was not a caching dns server. But that seems to be the case now. Which in a way makes things worse, because hotspots could then keep long lived forged records in my cache? Unless they flush all the cache on any network interface change, which in itself would cause me to leave my fingerprints all over the internet for pervasive monotiring attacks.

[DebianXFCE Jr]

to all languages without thoughts on backwards compatibility. all "modern" widely uses languages had some huge corporation to push it. and btw there exists modern version of c, it is called c++17

As the name implies C++17 isn't C. C standards are named like C99 or C11.
The C++17 is based on C but it is also an object oriented language. Where C has nothing to do with object approach. And Objective-C is a language developed for Apple products. Maybe you should learn first about the C family differences between them and even between particular standards to post comments?

[boxie]

ok, now you have to name a group which has foss dns without vulnerabilities with features of systemd-resolved, imbecile

hey, name calling is not needed - does not add anything to the discussion and certainly does not put you in a superior position. The strawman argument that you put here is certainly not doing you any favours.

so let's state a few things:

• No software is without bugs.
• The great thing about FOSS software is that you can *add* features to existing software if it does not have what you need (although, you should probably already know this).
• Writing a DNS resolver is technically hard

so now with your strawman destroyed, shall we continue?

[computerquip]

If you can't control your emotions, don't expect others to control their phrasing to mitigate your shortcomings

Not sure what that has to do with anything but it sounds mystical so it must be right.

[aht0]

so let's state a few things:

• No software is without bugs.
• The great thing about FOSS software is that you can *add* features to existing software if it does not have what you need (although, you should probably already know this).
• Writing a DNS resolver is technically hard

so now with your strawman destroyed, shall we continue?

Adding the features is half the issue here. What is more important for you, software quality or feature creep? Yeah, writing DNS resolver is hard but systemd-resolved is not resolver, it's only forwarder and even this is half-assed implementation, combined with a coding errors opening remote holes. It's pretty fucking critical component IF you are using it but seems like systemd devs only cared about getting a quick extra mark for systemd feature list.

[sdack]

Right...

You're still just a hater. I hope you get better one day!

[L_A_G]

You're still just a hater. I hope you get better one day!

So you think people shouldn't be allowed to dislike anything? How cute.

[sdack]

So you think people shouldn't be allowed to dislike anything? How cute.

*lol* Of course not. You only shouldn't dislike without reason. You still don't know me, but you thought I was a systemd fanboy. Now you think I'm cute, but the truth is, I'm awesome and you still only suck. *lol* Or how do you feel now? I bet you feel like lying. So give me your next comment. I know it's going to be something about how you're trying to keep your boat afloat. Looking forward to it. Bring the hate.

[aht0]

*lol* Of course not. You only shouldn't dislike without reason. You still don't know me, but you thought I was a systemd fanboy. Now you think I'm cute, but the truth is, I'm awesome and you still only suck. *lol* Or how do you feel now? I bet you feel like lying. So give me your next comment. I know it's going to be something about how you're trying to keep your boat afloat. Looking forward to it. Bring the hate.

Out of curiosity, what is there to especially like with this bumbled piece of coding? Broken design and 2 years of remote vulnerability should be reasons for special love?

Effect seems to be rather that every little indication of dislike is being instantly labeled as "unreasonable hate" and accompanied by intense personal attacks. Look into mirror, before chasing "unreasonable hate".. Yeah, people dare criticize your love-child.. Get over it.

[F.Ultra]

vulnerabilities present in systemd-resolved were predicted long a go by "systemd-haters".. no particular surprise..

The vulnerability just found have nothing to do with the things in that prediction which was ramblings about the binary to xml and back translation that systemd-resolved uses in order to pass the DNS data over D-BUS.

And if any one didn't notice (since it wasn't advertised everywhere due to not being systemd) there where a CVE issued early today for Bind.