Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

Post reply on HN
Print view View original

121–130 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#121

Post by strenholme »

dc396 wrote: post #101
rgkpz wrote: post #45

Earlier quoted context omitted.

"All software has bugs" is the most meaningless statement ever. It is just used for bonding with fellow bug writers who sit at a virtual campfire and muse about inevitabilities. Demonstrably some software has fewer bugs, and its authors are often hated, especially if they are a lone author like Bernstein. Because it must not happen! Projects with useless churn and many bug reports are more popular because only activi…

If DJB is "hated", it isn't because he's a lone author (Linus Torvalds was once a lone author and I don't think he was hated). It's because he can be an asshole. To quote George Bernard Shaw, “The reasonable man adapts himself to the world: the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man.”

DJB is a lot of things, and I have great respect for him, even though I feel he didn’t responsibly maintain Qmail/DJBdns/Publicfile. He made MaraDNS more secure because I carefully read his documentation—I got the idea to have a random source port to give MaraDNS more security from him, which means MaraDNS was unscathed when DNS spoofing was independently discovered in 2007.

The point DJB made was this: It was possible for a skilled C programmer to make a server with few security holes. Even though that’s not as relevant now, with Rust having most of the speed of C and security built in, it did make the Internet a safer place for many years. I remember using Qmail and DJBdns to make the servers at the small company I worked for at the time more secure.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#122

Post by strenholme »

koolba wrote: post #120
strenholme wrote: post #117

Earlier quoted context omitted.

I should explain how MaraDNS uses Lua 5.1 (actually, Lunacy, my own fork with security bugs fixed as well as security hardening—including, yes, a patch against CVE-2014-5461), so you can get an idea of its attack surface. MaraDNS has three components: • MaraDNS, the authoritative server, which goes back all the way to 2001 • Deadwood, the recursive server, which was started back in 2007 • coLunacyDNS, which allows a…

> coLunacyDNS, which allows a DNS server to use Lua scripting; this didn’t exist until the COVID pandemic Why would a DNS server use Lua scripting? Is this for dynamically responding to requests rather than doing a pure lookup?

It’s useful for things like 10.1.2.3.ip4.internal style queries, or having a DNS server that always returns a given IP for any query given to it.

More discussion is on the coLunacyDNS overview page:

https://samboy.github.io/MaraDNS/coLunacyDNS/

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#123

Post by strenholme »

gcr wrote: post #83
strenholme wrote: post #19

Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Not one single serious security bug has been found since 2023. [1] The only bugs auditers have been finding are things like “Deadwood, when fully recursive, will take longer than usual to release resources when getting this unusual packet” [2] or “This side utility included with MaraDNS, which ha…

MaraDNS is much less popular than dnsmasq though. I have several libraries that I've written. Not one single serious security bug in them has been found since 1991. Granted, nobody uses my libraries... Not to diminish your team's achievement! :D But it's important to contextualize claims like this with information about what your userbase looks like

A lot of security and other audits have been performed against it though; MaraDNS, after all, is notable enough to have a Wikipedia page and hundreds of GitHUB stars.

For example, when the Ghost Domain Name DNS vulnerability was discussed, MaraDNS was audited and named (MaraDNS was immune to the security bug, for the record)

https://web.archive.org/web/20120304054959/https://www.isc.o...

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#125

Post by shakna »

strenholme wrote: post #116
shakna wrote: post #66

Earlier quoted context omitted.

Well, as you bundle Lua 5.1 (as Lunacy), instead of making a library and loading it, and you bundled the 2012 version, you're probably affected by CVE-2014-5461 and others. Lua hasn't been security fix free.

Thank you for your concern. I fixed CVE-2014-5461 for Lunacy back in 2021: https://github.com/samboy/lunacy/commit/4de84e044c1219b06744... This is discussed here: https://samboy.github.io/MaraDNS/webpage/security.html#CVE-2... In addition, I have done other security hardening with Lunacy compared to Lua 5.1: https://samboy.github.io/MaraDNS/webpage/lunacy/ Now, I should probably explain why I’m using Lua 5.1 instead…

Yeah, I've had patches submitted to Moonscript, Fengari, and luau. Don't need to sell on why 5.1 is useful. Each version is a new lang, not just a few fixes or niceties.

I'm not convinced that vendoring, instead of embedding, is the right way.

The patch landing in 2021, instead of 2014, being one of those concerns.

(And you might want to recheck your assumption of how big 'int' will be, for rg32. C defines it in terms of minimum size, not direct size. int16_t isn't necessarily an alias.)

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#126

Post by vasco »

rgkpz wrote: post #45
binaryturtle wrote: post #43

Earlier quoted context omitted.

That's a bit shameless, indeed. dnsmasq has served me well for like an eternity in multiple setups for different use cases. As all software it has bugs. And once located those get fixed. Its author is also easy to communicate with. Why should I switch over to something way less proven? I'm quite sure your software also has bugs, many still not located. Maybe because it's less popular/ less well known nobody cares to…

"All software has bugs" is the most meaningless statement ever. It is just used for bonding with fellow bug writers who sit at a virtual campfire and muse about inevitabilities. Demonstrably some software has fewer bugs, and its authors are often hated, especially if they are a lone author like Bernstein. Because it must not happen! Projects with useless churn and many bug reports are more popular because only activi…

> Demonstrably some software has fewer bugs

You literally write fewer instead of none, therefore agreeing with the sentence you claimed to say is meaningless.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#128

Post by SoftTalker »

magicalhippo wrote: post #119
cwillu wrote: post #68

Earlier quoted context omitted.

That line of thinking is exactly why I ended up using maradns for my dns hosting way back. 10/10, no regrets, would recommend.

What do you use for DHCP and how do you have DHCP update local DNS entries? Or do you just rely on mDNS to work?

I use dhcpd. It doesn't update local DNS entries. I have no need for that.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#129

Post by zamadatix »

strenholme wrote: post #60
zamadatix wrote: post #52

Earlier quoted context omitted.

"All software has bugs" so "be wary of the one trying to say they haven't had any in 3 years" not so "I guess all are equal". For extremely low security bug rates either the scope is extremely narrow, the claim is dubious, or the project is a massive effort which the community talks about directly in posts rather than plugs (e.g. curl).

DJB, with Qmail and DjbDNS (as well as Publicfile, which didn’t catch on in an era of CGI scripts), showed that one could have (mostly) security bug free software without the scope being “extremely narrow”, and without the claim being “dubious”. It’s not normal for software to be so poorly written, one doubts the claim that a security bug hasn’t been found in over three years. If one thinks the claim of no security b…

I never used Qmail, so I won't comment on it, but I will say I absolutely consider djbdns narrow in scope as well (before accounting the Unix approach, utilized perhaps even more than in MaraDNS, to break that already narrowed scope down into even more focused binaries).

I had believed (and continue to hold) DNS software containing, e.g., an authoritative DNS server which lacks native TCP or DNSSEC support falls squarely into the "narrowly scoped" bucket and would appreciate if you'd not try to decide my opinion for me on any given project in the future.

Post reply on HN