samba-mirror

mirror of https://github.com/samba-team/samba.git synced 2025-02-04 17:47:26 +03:00

History

Kai Blin 392ec4d241 bug #10609 : CVE-2014-0239 Don't reply to replies

Due to insufficient input checking, the DNS server will reply to a packet that
has the "reply" bit set. Over UDP, this allows to send a packet with a spoofed
sender address and have two servers DOS each other with circular replies.

This patch fixes bug #10609 and adds a test to make sure we don't regress.
CVE-2014-2039 has been assigned to this issue.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10609

Signed-off-by: Kai Blin <kai@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Kai Blin <kai@samba.org>
Autobuild-Date(master): Tue May 20 04:15:44 CEST 2014 on sn-devel-104

2014-05-20 04:15:44 +02:00

dlz_bind9.c

kerberos: Remove un-used event context argument from smb_krb5_init_context()

2014-04-28 02:24:57 +02:00

dlz_minimal.h

dlz_bind9: Build shared libraries for both BIND versions 9.8 and 9.9

2012-04-16 11:16:34 +10:00

dns_crypto.c

dns: Use new DNS debugclass in DNS server

2013-05-16 21:40:15 +10:00

dns_query.c

s4:dns_server: make use of gensec_update_ev()