GNU nscd Incorrect Hosts Cache Behavior Vulnerability

Bugtraq ID:	4399
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Mar 26 2002 12:00AM
Updated:	Mar 26 2002 12:00AM
Credit:	Credited to Louis Imershein <[email protected]>.
Vulnerable:	nscd nscd 2.2.4 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1
Not Vulnerable:

GNU nscd Incorrect Hosts Cache Behavior Vulnerability

The GNU Name Service Cache Daemon (nscd) provides a cache for common name service requests. It is able to cache requests against the hosts, groups and passwd databases.

A vulnerability has been reported in some versions of nscd. If a request is made for a DNS PTR record, the returned name is cached. If a subsequent A lookup is made against this name, the IP address of the original query is returned.

GNU nscd Incorrect Hosts Cache Behavior Vulnerability

No exploit is required.

GNU nscd Incorrect Hosts Cache Behavior Vulnerability

Solution:
Caldera suggests disabling the hosts cache in /etc/nscd.conf by adding the line:

enable-cache hosts no

Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

GNU nscd Incorrect Hosts Cache Behavior Vulnerability

References: