ID

VAR-201009-0232

CVE

CVE-2010-2952

TITLE

Apache Traffic Server Inside DNS Cash poisoning vulnerability

DESCRIPTION

Apache Traffic Server before 2.0.1, and 2.1.x before 2.1.2-unstable, does not properly choose DNS source ports and transaction IDs, and does not properly use DNS query fields to validate responses, which makes it easier for man-in-the-middle attackers to poison the internal DNS cache via a crafted response. DNS May be disguised. Traffic Server is an open source proxy server and web cache server developed by the Apache Software Foundation. The application implementation has security issues that allow malicious users to perform DNS cache poison attacks. Apache Traffic Server is prone to a remote DNS cache-poisoning vulnerability. An attacker can exploit this issue to divert data from a legitimate site to an attacker-specified site. Successful exploits will allow the attacker to manipulate cache data, potentially facilitating man-in-the-middle, site-impersonation, or denial-of-service attacks. ---------------------------------------------------------------------- Windows Applications Insecure Library Loading The Official, Verified Secunia List: http://secunia.com/advisories/windows_insecure_library_loading/ The list is continuously updated as we confirm the vulnerability reports so check back regularly too see if any of your apps are affected. ---------------------------------------------------------------------- TITLE: Apache Traffic Server DNS Cache Poisoning Vulnerability SECUNIA ADVISORY ID: SA41356 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/41356/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=41356 RELEASE DATE: 2010-09-09 DISCUSS ADVISORY: http://secunia.com/advisories/41356/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/41356/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=41356 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Tim Brown has reported a vulnerability in Apache Traffic Server, which can be exploited by malicious people to poison the DNS cache. SOLUTION: Update to version 2.0.1. PROVIDED AND/OR DISCOVERED BY: Tim Brown, Nth Dimension. ORIGINAL ADVISORY: Apache: https://issues.apache.org/jira/browse/TS-425 Tim Brown: http://www.nth-dimension.org.uk/pub/NDSA20100830.txt.asc OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Nth Dimension Security Advisory (NDSA20100830) Date: 30th August 2010 Author: Tim Brown <mailto:timb@nth-dimension.org.uk> URL: <http://www.nth-dimension.org.uk/> / <http://www.machine.org.uk/> Product: Traffic Server 2.1.1, 2.0.0 <http://trafficserver.apache.org/> Vendor: Apache Software Foundation <http://www.apache.org/> / Yahoo! Inc Risk: Medium Summary This advisory comes in 3 related parts: 1) Traffic Server uses a static (per DNS server) source port for making outgoing DNS queries. 2) Traffic Server uses a sequential transaction ID when constructing asynchronous DNS queries. Moreover the algorithm used to select the intitial transation ID is not sufficiently random. These vulnerabilities might significantly increase the chances of Traffic Server's internal DNS cache being poisoned. After discussions with the vendor, CVE-2010-2952 was assigned to this vulnerability. The port is chosen at runtime using the DNSConnection::connect() method from iocore/dns/DNSConnection.cc: struct sockaddr_in bind_sa; memset(&sa, 0, sizeof(bind_sa)); bind_sa.sin_family = AF_INET; bind_sa.sin_addr.s_addr = INADDR_ANY; int p = time(NULL) + offset; p = (p % (LAST_RANDOM_PORT - FIRST_RANDOM_PORT)) + FIRST_RANDOM_PORT; bind_sa.sin_port = htons(p); Debug("dns", "random port = %d\n", p); if ((res = socketManager.ink_bind(fd, (struct sockaddr *) &bind_sa, sizeof(bind_sa), Proto)) < 0) { offset += 101; continue; } Note that since FIRST_RANDOM_PORT is set to 16000, LAST_RANDOM_PORT is defined as 32000 and since the underlying algorith is predictable, the source port may be guessed. The base number is set at runtime using the DNSProcessor::dns_init() method from iocore/dns/DNS.cc: if (cval > 0) { dns_sequence_number = (unsigned int) (cval + DNS_SEQUENCE_NUMBER_RESTART_OFFSET); Debug("dns", "initial dns_sequence_number (cval) = %d\n", (u_short) dns_sequence_number); } else { // select a sequence number at random dns_sequence_number = (unsigned int) (ink_get_hrtime() / HRTIME_MSECOND); Debug("dns", "initial dns_sequence_number (time) = %d\n", (u_short) dns_sequence_number); } and then incremented on each subsequent request as seen in the write_dns_event() function: ++dns_sequence_number; ... u_short i = (u_short) dns_sequence_number; ((HEADER *) (buffer))->id = htons(i); 3) When processing responses, Traffic Server walks a linked list which holds details of each attempted request and compares the incoming ID with its list to ascertain which request a given response relates. This can be seen in the dns_process() function from iocore/dns/DNS.cc: DNSEntry *e = get_dns(handler, (u_short) ntohs(h->id)); ... inline static DNSEntry * get_dns(DNSHandler * h, u_short id) { for (DNSEntry * e = h->entries.head; e; e = (DNSEntry *) e->link.next) { if (e->once_written_flag) for (int j = 0; j < MAX_DNS_RETRIES; j++) if (e->id[j] == id) return e; else if (e->id[j] < 0) goto Lnext; Lnext:; } return NULL; } Solutions Nth Dimension recommends that the vendor supplied patches should be applied. History On 20th August 2010, Nth Dimension contacted both Yahoo! Inc and the Apache Software Foundation's security teams to report the described vulnerabilities affecting Traffic Server. Yahoo's team responded immediately to confirm that that the report had been recieved and forwarded to the relevant people. Following on from this, Nth Dimension and the Traffic Server developers opened a dialogue and the issue and potential remediations were discussed at length. After offering feedback on Leif Hedstrom's original analysis, Steve Jiang went away and produced a patch based on Nth Dimension's comments. On the 27th August, the vulnerability was assigned CVE-1010-2952 and Lief distributed a proposed patch for feedback from other Traffic Server developers. Current As of the 30th August 2010, the state of the vulnerabilities is believed to be as follows. A patch has been supplied by the upstream which it is believed successfully mitigates the final symptoms of this vulnerability. New releases of both 2.0.x and 2.1.x have also been created which incorporate this patch. Thanks Nth Dimension would like to thank the Apache Software Foundation for the way they worked to resolve the issue. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQIcBAEBCAAGBQJMh4S+AAoJEPJhpTVyySo7kwMP/0wIPmO4nNyOhoF0VuUWqLvj Q7JzQ5xqLeU932Yp+AlDGvHgWYtKZP64Oi5vrkNavhhCRNhSuWMWrbiFb7NgmTdv EFualmdRXjhZY8O5cLoS6MuCYelosjuO2qDncgrV0xFZ59HXf7FRr/QSc/22Kaum Mp/DHItk3E1pTZD0BaVX34waCo01q6bPbfsJW0qZyPGUagfk8av6DobgQOwuiPXJ 4bNh4kgaZIY8bgCnOB/TmZM+pz7Tgh6yF2tbjc+0Qx/jdKi4Y+T9Jpv8oKx8+scM eHpb2iTFXUI7n5uie8nA8F1+Y0InEUr/GfppvEUzk/bHnfNuv5RAH7AuCpabf/kK +wnYMyhIN2vTmuxDfU/OB8uyzZIrCn6YmH/CFToutzP03I6SssdpsUM6qZd3p8Q/ GM+BYyNcBGk9IC1ikcalCjswtjekHjITJfpmosKyMGR2oFUR3Lh3dWGoDaG+7mSC w0TxA6FYtqfpJZngfnoBGwU3TGOpIf8S3KOBc7pYPsLBn9VFNAShJtHMi+Tcd/CD 2W9GJ0qJxy4EETJE5MG+PWrBOLQUVGheOxPtAmojHDXnBcfufAKpvCQkUmvdleTG ASqE0AiHB5r+4gXr7LIvvhT6hQrbDk3EEEseAGV2e7bT+jjHKA0IlbBcB1XW1kOW Y5sKeOJfAHl1iFu41rT4 =8naX -----END PGP SIGNATURE-----

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

input validation

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Tim Brown

SOURCES

LAST UPDATE DATE

2024-11-23T22:27:42.845000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE