[32065] in bugtraq
What software breaks because of this DNS feature?
daemon@ATHENA.MIT.EDU (Richard M. Smith)
Tue Oct 14 13:53:00 2003
From: "Richard M. Smith" <rms@computerbytesman.com>
To: "BUGTRAQ@SECURITYFOCUS. COM" <BUGTRAQ@securityfocus.com>
Date: Mon, 13 Oct 2003 17:18:27 -0400
Message-ID: <000901c391cf$8b7f7630$550ffea9@rms>
MIME-Version: 1.0
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: 8bit
Hi,
According to RFC1034, "cnn.com" and "cnn.com." should be the same domain
names. However, it doesn't appear that programmers always understand that
trailing dots can be added to domain names.
For example, these two URLs both go to the CNN Web site in Internet
Explorer:
http://www.cnn.com/
http://www.cnn.com./
However, Internet Explorer considers these two domain names to be different
when it comes to cookies. "cnn.com." gets a different cookie from "cnn.com"
This behavior of Internet Explorer is a bug, but probably not a particularly
bad one.
Here's another example at Internic which treats the query "com" different
than "com.".
http://reports.internic.net/cgi/whois?whois_nic=com&type=domain
http://reports.internic.net/cgi/whois?whois_nic=com.&type=domain
My two questions: How much other software behaves incorrectly because of a
trailing period on a domain name? Do any of these problems represent
serious bugs?
Richard M. Smith
http://www.ComputerBytesMan.com
