In message <87k482kw0l....@mid.deneb.enyo.de>, Florian Weimer writes:
> I've noticed that nobody seems to have accurate information about
> CVE-2006-2073 on file. This was a vulnerability in handling
> TSIG-based authentication *after* authentication, so it wasn't a high
> priority issue.
Actually it required the target server to be configured as a slave
to a custom built rogue master or for the attacker be in a position
to intercept the AXFR/IXFR request to a non compromised master. It
also required that TSIG not be being used to authenticate the
AXFR/IXFR request.
Access Vector: Network exploitable
Access Complexity: Low
Authentication: Not required to exploit
Impact Type:Allows disruption of service
I fail to see how this could ever have been classified as
Access Complexity: Low.
Looking at the CVE it looks like this bug fix contains the correction.
2013. [bug] Handle unexpected TSIGs on unsigned AXFR/IXFR
responses more gracefully. [RT #15941]
> What was the first BIND version that fixed it?
9.2.7, 9.3.3, 9.4.0.
> _______________________________________________
> Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
> from this list
>
> bind-users mailing list
> bind-users@lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: ma...@isc.org
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
