Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

Post reply on HN
Print view View original

111–120 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#111

Post by cesarb »

theamk wrote: post #84
shakna wrote: post #66

Earlier quoted context omitted.

Well, as you bundle Lua 5.1 (as Lunacy), instead of making a library and loading it, and you bundled the 2012 version, you're probably affected by CVE-2014-5461 and others. Lua hasn't been security fix free.

Unless the service accepts Lua code from the internet (and that would be a completely insane thing), the CVE-2014-5461 will not apply. And while I have not reviewed every Lua CVE, I bet most (all?) of then require a specifically crafted code, or at least highly-complex user input (such as arbitrary json) It's important to look at the actual vulnerability at the context, and not just list any CVE which matches by vers…

> It's important to look at the actual vulnerability at the context, and not just list any CVE which matches by version.

Unfortunately, that's not enough. Even if the vulnerable parts of the code are not being built, heck even if they have been completely erased from the source code, the auditors will still insist that you're vulnerable and must immediately upgrade, or else they will give your software a failing grade.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#112

Post by rhdnfjtkfmf »

andrewjf wrote: post #104
VorpalWay wrote: post #102

Earlier quoted context omitted.

Way fewer people are going to look at obscure things, so a lower percentage of issues will likely have been found. There is less fame and fotune in spending security research time on obscure software. Most small libraries won't be covered by any bug bounty programs either for example.

You don't need other people anymore to find security issues, you can do it yourself with AI.

Even accepting the premise, is it not immediately obvious to you that folks will be spending more money and effort aiming AI at higher-impact targets? This isn’t all-or-nothing.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#113

Post by cesarb »

toast0 wrote: post #58
koverstreet wrote: post #33

Earlier quoted context omitted.

You're going to have to update production at some point, and delaying it to once every 2 years is just deferred maintenance. And you know what they say about that... So when you do update and get that GSSAPI change, it comes with two years worth of other updates - and tracking that down mixed in with everything else is going to be all kinds of fun. And if you're two years out of the loop and it turns out upstream bro…

> You're going to have to update production at some point, and delaying it to once every 2 years is just deferred maintenance. And you know what they say about that... Doing terrible work every 2 years is better than doing it every day?

> Doing terrible work every 2 years is better than doing it every day?

And by skipping some releases, you will have less of that work. When something is changed in one release, then changed again on the next one, by waiting you only have to do the change once, instead of twice. And sometimes you don't even have to do anything, when something is introduced in one release and reverted in the next one.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#114

Post by throw0101c »

koverstreet wrote: post #33
zrm wrote: post #30

Earlier quoted context omitted.

> That whole model dates to before automated testing was even really a thing, and no one knew how to do QA; your QA was all the people willing to run your code and report bugs, and that took time. That's not what it's about. What it's about is, newer versions change things. A newer version of OpenSSH disables GSSAPI by default when an older version had it enabled. You don't want that as an automatic update because it…

You're going to have to update production at some point, and delaying it to once every 2 years is just deferred maintenance. And you know what they say about that... So when you do update and get that GSSAPI change, it comes with two years worth of other updates - and tracking that down mixed in with everything else is going to be all kinds of fun. And if you're two years out of the loop and it turns out upstream bro…

> You're going to have to update production at some point, and delaying it to once every 2 years is just deferred maintenance. And you know what they say about that...

Updated what, specifically in production?

If you need a newer version of Python or Postgres or whatever it is possible to install it from third-party repos or compile from source yourself. But having a team of folks watch all the other code out there is a load off my plate: not worrying about libc, or OpenSSH, or OpenSSL, or zlib, or a thousand other dependencies. If I need the latest version for a particular service I would install that separately, but otherwise the whole point of a 'packagized' system is to let other folks worry about those things.

> So when you do update and get that GSSAPI change, it comes with two years worth of other updates - and tracking that down mixed in with everything else is going to be all kinds of fun.

I've done in-place upgrades of Debian from version 5 to 11 at my last job on many machines, never once re-installing from scratch, and they've all gone fine.

Further, when updates come down from the Debian repos I don't worry about applying them because I know there's not going to be weird changes in behaviour: I'm more confident in deploying things like security updates because the new .deb files have very focused changes.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#115

Post by e12e »

koverstreet wrote: post #22
zrm wrote: post #12

Earlier quoted context omitted.

They're not going to put a newer version in stable. The way stable gets newer versions of things is that you get the newer version into testing and then every two years testing becomes stable and stable becomes oldstable, at which point the newer version from testing becomes the version in stable. The thing to complain about is if the version in testing is ancient.

No, that's exactly the thing to complain about. That whole model dates to before automated testing was even really a thing, and no one knew how to do QA; your QA was all the people willing to run your code and report bugs, and that took time. Not to mention, you think the C of today is bad? Have you looked at old C? And the disadvantage is that backporting is manual, resource intensive, and prone to error - and the p…

How do you do QA without locking a set of features?

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#116

Post by strenholme »

shakna wrote: post #66
strenholme wrote: post #19

Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Not one single serious security bug has been found since 2023. [1] The only bugs auditers have been finding are things like “Deadwood, when fully recursive, will take longer than usual to release resources when getting this unusual packet” [2] or “This side utility included with MaraDNS, which ha…

Well, as you bundle Lua 5.1 (as Lunacy), instead of making a library and loading it, and you bundled the 2012 version, you're probably affected by CVE-2014-5461 and others. Lua hasn't been security fix free.

Thank you for your concern.

I fixed CVE-2014-5461 for Lunacy back in 2021:

https://github.com/samboy/lunacy/commit/4de84e044c1219b06744...

This is discussed here:

https://samboy.github.io/MaraDNS/webpage/security.html#CVE-2...

In addition, I have done other security hardening with Lunacy compared to Lua 5.1:

https://samboy.github.io/MaraDNS/webpage/lunacy/

Now, I should probably explain why I’m using Lua 5.1 instead of the latest “official” version of Lua. Lua has an interesting history; in particular Lua 5.1 is the most popular version and the version which is most commonly used or forked against. Adobe Illustrator uses Lua 5.1, and Roblox uses a fork of Lua 5.1 called “luau”. LuaJIT is based on Lua 5.1, and other independent implementations of Lua (Moonsharp, etc.) are based on versions mostly compatible with Lua 5.1.

Lua 5.1 has a remarkably good security history, and of course I take responsibility for any security bugs in the Lua 5.1 codebase since I use the code with the relatively new coLunacyDNS server (Lua 5.1 isn’t used with the MaraDNS or Deadwood servers).

Lua 5.1 is used to convert documentation, but those scripts are run offline and the converted documents are part of the MaraDNS Git tree.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#117

Post by strenholme »

theamk wrote: post #84
shakna wrote: post #66

Earlier quoted context omitted.

Well, as you bundle Lua 5.1 (as Lunacy), instead of making a library and loading it, and you bundled the 2012 version, you're probably affected by CVE-2014-5461 and others. Lua hasn't been security fix free.

Unless the service accepts Lua code from the internet (and that would be a completely insane thing), the CVE-2014-5461 will not apply. And while I have not reviewed every Lua CVE, I bet most (all?) of then require a specifically crafted code, or at least highly-complex user input (such as arbitrary json) It's important to look at the actual vulnerability at the context, and not just list any CVE which matches by vers…

I should explain how MaraDNS uses Lua 5.1 (actually, Lunacy, my own fork with security bugs fixed as well as security hardening—including, yes, a patch against CVE-2014-5461), so you can get an idea of its attack surface.

MaraDNS has three components:

• MaraDNS, the authoritative server, which goes back all the way to 2001

• Deadwood, the recursive server, which was started back in 2007

• coLunacyDNS, which allows a DNS server to use Lua scripting; this didn’t exist until the COVID pandemic

Neither MaraDNS nor Deadwood use Lunacy (except as a scripting engine for converting documents); only coLunacyDNS uses Lunacy. coLunacyDNS uses a sandboxed and security hardened version of Lunacy (and, yes, I would accept bugs where someone could escape that sandbox), and the Lua scripts which coLunacyDNS uses can only be controlled by a local user and there is no capability to run Lua scripts remotely.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#118

Post by strenholme »

shakna wrote: post #90
theamk wrote: post #84

Earlier quoted context omitted.

Unless the service accepts Lua code from the internet (and that would be a completely insane thing), the CVE-2014-5461 will not apply. And while I have not reviewed every Lua CVE, I bet most (all?) of then require a specifically crafted code, or at least highly-complex user input (such as arbitrary json) It's important to look at the actual vulnerability at the context, and not just list any CVE which matches by vers…

Its important to maintain your dependencies, by say embedding Lua, rather than rebranding it and then claiming you have no security flaws. If I can find a CVE that _may_ affect the stack in five minutes, what _actual_ problems lurk there? You vendor Lua - thus, it _is_ your responsibility to review every Lua CVE. You've set yourself up as the maintainer by vendoring.

You weren’t replying to me. The parent poster made a good point—a vulnerability in Lua doesn’t mean software running Lua can necessarily be exploited—but, more to the point, I do update Lunacy and make sure it’s secure, just as I still take responsibility for verified important security holes in MaraDNS.

See this, for example:

https://samboy.github.io/MaraDNS/webpage/security.html#CVE-2...

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#119

Post by magicalhippo »

cwillu wrote: post #68
SoftTalker wrote: post #49

Never liked using dnsmasq. Always felt like too much in one tool. A local caching resolver, dhcp server, and tftp/pxe boot setup were always things I preferred to configure separately.

That line of thinking is exactly why I ended up using maradns for my dns hosting way back. 10/10, no regrets, would recommend.

What do you use for DHCP and how do you have DHCP update local DNS entries? Or do you just rely on mDNS to work?

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#120

Post by koolba »

strenholme wrote: post #117
theamk wrote: post #84

Earlier quoted context omitted.

Unless the service accepts Lua code from the internet (and that would be a completely insane thing), the CVE-2014-5461 will not apply. And while I have not reviewed every Lua CVE, I bet most (all?) of then require a specifically crafted code, or at least highly-complex user input (such as arbitrary json) It's important to look at the actual vulnerability at the context, and not just list any CVE which matches by vers…

I should explain how MaraDNS uses Lua 5.1 (actually, Lunacy, my own fork with security bugs fixed as well as security hardening—including, yes, a patch against CVE-2014-5461), so you can get an idea of its attack surface. MaraDNS has three components: • MaraDNS, the authoritative server, which goes back all the way to 2001 • Deadwood, the recursive server, which was started back in 2007 • coLunacyDNS, which allows a…

> coLunacyDNS, which allows a DNS server to use Lua scripting; this didn’t exist until the COVID pandemic

Why would a DNS server use Lua scripting? Is this for dynamically responding to requests rather than doing a pure lookup?

Post reply on HN