DNSTools Input Validation Vulnerability
BID:1028
Info
DNSTools Input Validation Vulnerability
| Bugtraq ID: | 1028 |
| Class: | Input Validation Error |
| CVE: |
CVE-2000-0177 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 02 2000 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list by Jonathan Leto <[email protected]> on March 2, 2000. |
| Vulnerable: |
DNSTools Software DNSTools 1.10 DNSTools Software DNSTools 1.0.8 |
| Not Vulnerable: | |
Solution / Fix
DNSTools Input Validation Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
The vendor has been contacted and have patched the 1.10 release of DNSTools. See message from Wolfgang Wiese <[email protected]> in reference section.
The best short term solution is to disable the DNSTools CGIs all together. If you feel confident, the code can be editted to prevent the vulnerabilities by dictating that only acceptable characters be allowed in post variables. This could be achieved as follows:
if(!($domain_name =~ /^[a-zA-Z]*$/)) { print "Error"; exit -1;};
Assuming only A-Z and a-z are allowable characters. Please note, this will not address all the problematic post variables, nor is it guaranteed to eliminate other problems.
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
The vendor has been contacted and have patched the 1.10 release of DNSTools. See message from Wolfgang Wiese <[email protected]> in reference section.
The best short term solution is to disable the DNSTools CGIs all together. If you feel confident, the code can be editted to prevent the vulnerabilities by dictating that only acceptable characters be allowed in post variables. This could be achieved as follows:
if(!($domain_name =~ /^[a-zA-Z]*$/)) { print "Error"; exit -1;};
Assuming only A-Z and a-z are allowable characters. Please note, this will not address all the problematic post variables, nor is it guaranteed to eliminate other problems.