SoylentNews is people
SoylentNews
Whether you're running systemd happily or begrudgingly, it's best if you disable systemd-resolved as your DNS resolver for the time being. Reported today at seclists is a new DNS cache poisoning bug in systemd-resolved.
At its simplest, an attacker triggers a query to a domain he controls via SMTP or SSH-login. Upon receipt of the question, he can just add any answer he wants to have cached to the legit answer he provides for the query, e.g. providing two answer RR's: One for the question asked and one for a question that has never been asked - even if the DNS server is not authoritative for this domain.
Systemd-resolved accepts both answers and caches them. There are no reports as to the affected versions or how widespread the problem may be. Comments over at Hacker News suggests that it might not be widespread, most users would still be running the backported 208-stable while the DNS resolver was committed in 213 and considered fairly complete in 216, but that is if they enabled systemd-resolved in /etc/nsswitch.config.
(Score: 3) by novak on Thursday November 13 2014, @03:54AM
That is a big part of why there are so few bugs. But that's not why I'm staying away. I'm staying away because of the laughable design choices.
This is a good example, a bug in a feature that should not even exist. It's not like systemd has to resolve domain names, there's any amount of other software which already does this. I prefer options, and one of those options is what DNS resolver/cache to run. I don't want RedHat or anyone else inventing the One True Software which has every subsystem tied together through a mystical API that changes whenever they want.
novak