[28248] in bugtraq
Re: PFinger 0.7.8 format string vulnerability (#NISR16122002B)
daemon@ATHENA.MIT.EDU (Andreas Borchert)
Wed Dec 18 15:01:27 2002
Date: Wed, 18 Dec 2002 15:16:44 +0100
From: Andreas Borchert <bugtraq@andreas-borchert.de>
To: bugtraq@securityfocus.com
Message-ID: <20021218141644.GA1306@mellifont.in-ulm.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20021217063723.GA18608@php.net>
On Tue, Dec 17, 2002 at 07:37:23AM +0100, Stefan Esser wrote:
> Yes noone said it is not, but fact is, the libc resolvers simply do not
> allow them, so you can send through the wire whatever you want it will
> not find its way to the fingerd.
Any resolver who disallows a % or any other character _by default_
is in violation of RFC 2181, section 11:
``Similarly, any binary string can serve as the value of any record
that includes a domain name as some or all of its value (SOA, NS, MX,
PTR, CNAME, and any others that may be added). Implementations of the
DNS protocols must not place any restrictions on the labels that can
be used. In particular, DNS servers must not refuse to serve a zone
because it contains labels that might not be acceptable to some DNS
client programs. A DNS server may be configurable to issue warnings
when loading, or even to refuse to load, a primary zone containing
labels that might be considered questionable, however this should
not happen by default.''
[http://www.rfc-editor.org/rfc/rfc2181.txt]
See also RFC 1123, section 6.1.3.5:
``The DNS defines domain name syntax very generally -- a string of
labels each containing up to 63 8-bit octets, separated by dots,
and with a maximum total of 255 octets.''
[http://www.rfc-editor.org/rfc/rfc1123.txt]
A conforming resolver is part of the djbdns package, see
http://cr.yp.to/djbdns/blurb/library.html
and http://cr.yp.to/djbdns/idn.html
BIND provides an option ``no-check-names'' in /etc/resolv.conf to
switch off the filtering function for its resolver library:
394. [feature] add RES_NOCHECKNAME and "options no-check-names" (in
resolv.conf) to turn off modern host/mail name checks.
[http://www.isc.org/ml-archives/bind-users/1999/01/msg00136.html]
This is supported since release 8.2-T1A.
Andreas Borchert
