DNSTools Input Validation Vulnerability

Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com.

The vendor has been contacted and have patched the 1.10 release of DNSTools. See message from Wolfgang Wiese <wolfgang.wiese@rrze.uni-erlangen.de> in reference section.

The best short term solution is to disable the DNSTools CGIs all together. If you feel confident, the code can be editted to prevent the vulnerabilities by dictating that only acceptable characters be allowed in post variables. This could be achieved as follows:

if(!($domain_name =~ /^[a-zA-Z]*$/)) { print "Error"; exit -1;};

Assuming only A-Z and a-z are allowable characters. Please note, this will not address all the problematic post variables, nor is it guaranteed to eliminate other problems.


Privacy Statement
Copyright 2010, SecurityFocus