(dnsmasq 鐃舜わ申鐃宿居申鐃緒申鐃緒申) CVE-2015-7547 glibc鐃緒申getaddrinfo 鐃緒申 stack buffer overflow 鐃緒申鐃夙種申鐃緒申[Linux]
鐃竣￥申鐃緒申鐃緒申鐃順き鐃緒申鐃夙種申鐃緒申鐃緒申鐃出まわ申鐃緒申鐃緒申glibc2.9 鐃淑降わ申発鐃緒申鐃緒申鐃緒申鐃夙種申鐃緒申鐃叔わ申鐃緒申
鐃旬細わ申
CVE-2015-7547: glibc getaddrinfo stack-based buffer overflow
https://googleonlinesecurity.blogspot.jp/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
鐃祝詳わ申鐃緒申鐃叔わ申鐃緒申鐃緒申扮洞鐃緒申鐃緒申鐃緒申鐃緒申妊鐃緒申鐃緒申肇鐃俊ュー鐃緒申鐃緒申鐃熟駕申鐃緒申鐃緒申鐃縮わ申
| Distribution | Vuluneable |
| RHEL5/CentOS5 | 鐃緒申鐃緒申鐃淑わ申 |
| RHEL6/CentOS6 | 鐃緒申鐃緒申鐃緒申 |
| RHEL7/CentOS7 | 鐃緒申鐃緒申鐃緒申 |
| Debian squeeze | 鐃緒申鐃緒申鐃緒申 |
| Debian wheezy | 鐃緒申鐃緒申鐃緒申 |
| Debian jessie | 鐃緒申鐃緒申鐃緒申 |
鐃緒申鐃塾常申鐃緒申浪鐃緒申鐃緒申鐃緒申鐃�
CVE-2015-7547: Critical Vulnerability in glibc getaddrinfo
https://isc.sans.edu/forums/diary/CVE20157547+Critical+Vulnerability+in+glibc+getaddrinfo/20737/
getaddrinfo() 鐃緒申箸辰討鐃緒申鐃祝￥申鐃銃駈申鐃緒申鐃緒申鐃緒申鐃緒申能鐃緒申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃�
鐃緒申鐃叔わ申 PoC 鐃熟醐申鐃緒申鐃緒申鐃緒申討鐃緒申討鐃緒申泙鐃緒申鐃�
https://github.com/fjserna/CVE-2015-7547
鐃緒申鐃緒申鐃祝醐申鐃緒申鐃緒申鐃緒申討鐃緒申鐃� CVE-2015-7547-proc.py 鐃夙わ申鐃緒申 root 鐃緒申鐃緒申鐃春わ申鐃叔実行わ申鐃緒申函鐃緒申鐃緒申亮鐃緒申 buffer overflow 鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申僖鐃緒申奪箸鐃緒申屬鐃緒申討鐃緒申鐃� DNS鐃緒申鐃緒申奪鐃緒申絅居申鐃緒申个鐃宿わ申鐃祝なってわ申鐃緒申泙鐃緒申鐃�
鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃銃逸申鐃緒申鐃緒申鐃緒申鐃緒申屬鐃� /etc/resolv.conf 鐃緒申
nameserver 127.0.0.1
鐃夙わ申鐃緒申函鐃�
$ ssh www.example.jp
Segmentation fault
鐃夙わ申鐃緒申鐃緒申鐃緒申鐃叔￥申鐃緒申鐃緒申討鐃緒申鐃殉わ申鐃緒申
鐃緒申鐃緒申鐃緒申鐃緒申鐃縮わ申DNS鐃緒申鐃緒申奪鐃緒申絅居申鐃緒申个蓮鐃緒申鐃緒申亮鐃緒申 malformed packet 鐃熟￥申鐃所ゾ鐃緒申个砲鐃緒申屬鐃緒申鐃� SERVFAIL 鐃緒申鐃瞬わ申泙鐃緒申鐃�
鐃淑ので￥申鐃銃駈申鐃緒申鐃緒申鐃緒申鐃� Linux 鐃緒申鐃緒申鐃夙わ申鐃銃わ申鐃緒申 DNS鐃緒申鐃緒申奪鐃緒申絅居申鐃緒申个鐃緒申鐃緒申鐃淑�鐃緒申鐃緒申鐃緒申鐃緒申鐃銃わ申鐃緒申unbound 鐃緒申鐃獣わ申鐃緒申 bind 鐃緒申鐃獣わ申鐃所す鐃緒申鐃緒申砲蓮鐃縦常申鐃銃駈申鐃緒申鐃緒申鐃緒申覆鐃緒申箸鐃緒申辰討鐃緒申鐃緒申隼廚鐃緒申泙鐃緒申鐃緒申謬鐃緒申鐃緒申鐃述わ申鐃殉わ申鐃緒申鐃緒申鐃緒申念鐃淑わ申鐃初こ鐃緒申鐃緒申鐃緒申任蝋鐃緒申鐃塾駕申能鐃緒申鐃緒申鐃緒申鐃緒申鐃俊緒申鐃叔わ申鐃淑わ申鐃緒申鐃緒申鐃叔わ申鐃祝￥申aws 鐃叔は影駈申鐃緒申鐃淑わ申鐃夙のワ申鐃緒申鐃夙わ申鐃出わ申鐃緒申討鐃緒申泙鐃緒申鐃�
CVE-2015-7547 Advisory
https://aws.amazon.com/jp/security/security-bulletins/cve-2015-7547-advisory/
EC2 customers using the AWS DNS infrastructure are unaffected and don鐃緒申t need to take any action.
鐃夙は醐申鐃緒申鐃淑わ申鐃緒申癲�鐃夙種申鐃緒申鐃熟残ってわ申鐃緒申里如鐃緒申鐃緒申鐃緒申肇鐃緒申奪廛如鐃緒申箸鐃緒申討鐃緒申鐃緒申泙鐃緒申腓�鐃緒申鐃緒申鐃獣プデ￥申鐃夙醐申蓮鐃緒申鼎鐃緒申薀わ申屮鐃緒申鐃緒申匹濆鐃緒申鐃緒申鐃殉まわ申鐃獣わ申鐃夙わ申鐃緒申鐃緒申鐃夙わ申鐃淑わ申鐃処う鐃祝￥申鐃緒申鐃緒申鐃出わ申 reboot 鐃緒申鐃銃わ申鐃緒申鐃夙わ申鐃緒申鐃夙思わ申鐃殉わ申鐃緒申
# lsof -d DEL
鐃緒申鐃銃￥申鐃緒申鐃緒申鐃獣ぱわ申鐃緒申鐃初該鐃緒申鐃緒申鐃緒申 daemon 鐃緒申撞鐃銃逸申鐃緒申鐃獣てのでもい鐃緒申鐃緒申鐃盾し鐃緒申泙鐃緒申鵑�￥申
鐃緒申鐃緒申辰鐃緒申坩造覆里鐃�
@kunitake @tss_ontap Internet鐃緒申離鐃緒申鐃獣ワ申鐃緒申DNS鐃緒申鐃緒申鐃出を参照わ申鐃銃わ申鐃銃わ申鐃緒申鐃順、spoof鐃緒申鐃曙た鐃術ワ申鐃獣トで刻申鐃緒申鐃叔緒申鐃緒申福鐃緒申鐃緒申隼廚辰討鐃緒申泙鐃緒申鐃�8.8.8.8鐃夙わ申鐃緒申箸辰討鐃緒申鐃緒申鐃緒申(鐃緒申名鐃淑のわ申)鐃緒申鐃緒申鐃駿わ申鐃緒申鐃緒申鐃暑か鐃盾し鐃緒申泙鐃緒申鐃緒申
— Mitsuru SHIMAMURA (@smbd) 2016, 2鐃緒申 17
鐃殉わ申libc鐃熟ワ申鐃緒申鐃瞬リゾ鐃緒申个覆呂鐃緒申覆里如鐃緒申鐃緒申鐃獣ワ申鐃遵サ鐃緒申鐃出で一元的鐃緒申鐃巡い鐃緒申錣誌申離鐃緒申縫鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申鐃出￥申鐃春ワ申鐃緒申鐃準ウ鐃緒申鐃緒申鐃緒申鐃緒申鐃叔わ申鐃淑わ申鐃緒申鐃緒が鐃緒申鐃銃わ申LAN鐃淑わ申鐃緒申鐃熟でわ申鐃緒申鐃緒申鐃淑￥申鐃叔も、鐃瞬ワ申鐃緒申鐃宿バワ申疋襦種申鐃緒申箸鐃緒申鐃緒申箸覆鐃緒申覆鐃緒申颪靴鐃�
— AoiMoe (@AoiMoe) 2016, 2鐃緒申 17
鐃緒申鐃塾わ申鐃緒申鐃緒申任鐃緒申鐃緒申諭鐃緒申超鐃緒申砲鐃獣ては￥申鐃緒申造鐃術ワ申鐃獣トとわ申鐃緒申鐃緒申鐃緒申鐃緒申鐃叔削申鐃緒申鐃緒申鐃殉れた鐃所す鐃緒申鐃叔緒申鐃緒申發�鐃緒申里如鐃緒申鐃緒申佞鐃宿�鐃竣でわ申鐃緒申
鐃緒申鐃緒申鐃緒申鐃獣わ申鐃峻安わ申鐃緒申鐃緒申超鐃緒申如鐃緒申匹鐃緒申鐃緒申討發刻申鐃緒申砲魯鐃緒申奪廛如鐃緒申箸任鐃緒申覆鐃緒申覆鐃� dnsmasq 鐃緒申店鐃緒申鐃叔わ申鐃緒申鐃縦にリゾ鐃緒申个鐃緒申鐃緒申鐃銃￥申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申討鐃初い鐃殉わ申鐃順う鐃緒申鐃緒申鐃緒申鐃粛�鐃緒申鐃緒申 workaround 鐃夙なわ申泙鐃�(鐃宿居申鐃緒申鐃緒申劼鐃緒申泙鐃緒申鐃緒申鐃緒申匹鐃緒申發鰹申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申鐃�workaround探鐃緒申鐃銃わ申鐃緒申屬縫鐃緒申奪廛如鐃緒申箸鐃緒申討鐃緒申泙鐃緒申泙鐃緒申腓�鐃緒申鐃緒申
ps. 鐃宿わ申鐃叔もい鐃緒申鐃叔わ申鐃緒申鐃緒申unbound 鐃緒申 do-not-query-localhost 鐃緒申 default 鐃緒申 yes 鐃祝なってわ申鐃暑こ鐃夙に居申鐃重わ申鐃緒申鐃緒申(鐃夙わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃盾そ鐃盾そ鐃緒申鐃緒申鐃緒申鐃緒申鐃所が鐃緒申鐃暑こ鐃夙に居申鐃重わ申鐃緒申鐃祝）￥申鐃淑わ申鐃淑わ申鐃銃ワ申鐃夙わ申鐃叔わ申鐃緒申鐃祝ハマわ申泙鐃緒申鐃緒申帖鐃�
鐃宿居申鐃緒申鐃塾ｏ申: 2016/02/18 02:17 JST
@kunitake @AoiMoe @_hitsumabushi_ 鐃緒申鐃緒申任鐃緒申鐃� https://t.co/pBmcmOiRis 鐃叔￥申鐃緒申鐃緒申任鐃緒申鐃所ゾ鐃緒申亰鐃粛鰹申任鐃緒申鐃緒申筏鐃緒申椶鐃緒申鐃銃わ申閥鐃緒申鐃緒申討鐃初い鐃殉わ申鐃緒申鐃緒申PoC鐃塾ワ申鐃緒申鐃緒申鐃緒申DNS的鐃緒申鐃術な縁申鐃緒申鐃淑のわ申鐃宿わ申鐃暑が鐃緒申DNS的鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申發�鐃所う鐃緒申鐃�
— SODA Noriyuki (@n_soda) 2016, 2鐃緒申 17
鐃夙の常申鐃藷が￥申
https://access.redhat.com/articles/2161461
鐃祝は￥申鐃緒申鐃緒申鐃塾よう鐃淑居申鐃旬わ申鐃緒申鐃緒申泙鐃緒申鐃�
2. Can a trusted DNS resolver protect against this issue?
A trusted resolver, in a default, protocol-compliant configuration,
cannot mitigate this issue because potential exploits could involve
syntactically well-formed DNS responses.
鐃縦まり、DNS鐃緒申鐃緒申奪鐃緒申絅居申鐃緒申个任六鐃緒申佑鳳鐃獣てなわ申鐃術ワ申鐃獣トわ申 SERVFAIL 鐃緒申鐃緒申箸鐃緒申襪縁申鼻鐃緒申鐃緒申佑鳳鐃獣わ申鐃術ワ申鐃獣トはリゾ鐃緒申个鐃緒申屬鐃緒申討鐃緒申泙鐃緒申里如鐃緒申鐃緒申鐃緒申鐃緒申辰鐃緒申僖鐃緒申奪箸鐃緒申未鐃緒申胴鐃緒申鐃緒申能鐃緒申鐃夙わ申鐃緒申鐃緒申鐃夙のよう鐃叔わ申鐃緒申
鐃淑ので￥申Google Online Security Blog 鐃緒申鐃緒申鐃銃わ申鐃縮ｏ申鐃緒申討泙箸鐃緒申鐃�
(1) DNS鐃緒申鐃緒申奪鐃緒申絅居申鐃緒申个任蓮鐃緒申鐃緒申鐃緒申砲蝋鐃緒申鐃緒申鐃宿わ申鐃淑わ申
(2) getaddrinfo() 鐃緒申鐃夙種申鐃緒申鐃緒申鐃春わ申鐃祝わ申 2048鐃出ワ申鐃夙わ申曚鐃緒申鐃曙ス鐃楯ンスでわ申鐃緒申必鐃竣わ申鐃緒申鐃緒申
(3) dnsmasq 鐃塾よう鐃緒申(鐃宿居申鐃緒申鐃宿わ申鐃緒申鐃緒申劼鐃緒申鐃処う鐃祝￥申dnsmasq鐃叔は緒申分鐃緒申鐃緒申鐃渋わ申櫃鐃緒申鐃緒申覆鐃緒申鐃叔緒申鐃緒申鐃緒申鐃緒申鐃殉わ申鐃祝￥申鐃曙ス鐃楯ワ申長鐃緒申鐃緒申鐃緒申(2048鐃出ワ申鐃夙わ申曚鐃緒申鐃緒申鐃緒申覆鐃緒申砲鐃緒申櫃鐃緒申鐃緒申鐃緒申里鐃緒申鐃緒申鐃夙わ申鐃出器申鐃渋削申鐃夙わ申鐃銃使わ申鐃緒申
鐃夙わ申鐃緒申鐃緒申鐃夙のよう鐃叔わ申鐃緒申aws 鐃緒申鐃緒申鐃夙わ申DNS鐃緒申鐃緒申奪鐃緒申絅居申鐃緒申个鐃緒申鐃緒申僂鐃緒申討鐃緒申鐃渋わ申砲鐃緒申鐃緒申討榔洞鐃緒申鐃緒申覆鐃緒申箸鐃緒申辰討鐃緒申鐃塾は￥申鐃緒申鐃緒申鐃瞬リゾ鐃緒申个悗鐃緒申嵜鐃緒申鐃�2048鐃出ワ申鐃夙わ申曚鐃緒申覆鐃緒申茲�鐃祝わ申鐃銃わ申鐃暑ぜ鐃緒申鐃夙わ申鐃緒申鐃緒申鐃夙なのわ申鐃盾し鐃緒申泙鐃緒申鐃�
鐃夙もあ鐃曙、鐃緒申鐃緒申鐃祝誌申辰討浪鐃緒申鐃祝駕申鐃緒申鐃緒申鐃獣居申鐃緒申蝓�鐃緒申直鐃祝パッワ申鐃緒申鐃緒申鐃薯アップデ￥申鐃夙わ申鐃銃ワ申鐃緒申鐃出わ申撞鐃銃逸申鐃緒申討鐃緒申鐃緒申鐃緒申鐃緒申鐃縮居申鐃叔わ申鐃粛…￥申
鐃宿居申鐃緒申鐃塾ｏ申: 2016/02/18 15:50 JST
dnsmasq 鐃緒申鐃緒申鐃渋削申鐃夙わ申鐃銃使わ申鐃緒申箸鐃緒申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申呂鐃緒申鐃緒申蕕� 2.73 鐃緒申鐃緒申導鐃緒申鐃緒申鐃曙た
/* src/config.h */
#define SAFE_PKTSZ 1280 /* "go anywhere" UDP packet size */
鐃緒申鐃緒申鐃舜わ申鐃銃わ申鐃緒申鐃緒申鐃夙思わ申鐃殉わ申鐃緒申鐃熟￥申鐃宿ワ申鐃緒申鐃叔ワ申鐃藷グわ申 1280鐃出ワ申鐃夙わ申鐃緒申鐃渋わ申鐃緒申討鐃緒申鐃塾で￥申鐃緒申鐃緒申僖鐃緒申奪箸鐃緒申呂鐃緒申覆鐃緒申覆鐃殉わ申鐃緒申
On CVE-2015-7547 - glibc/getaddrinfo
http://lists.ipfire.org/pipermail/development/2016-February/001545.html
鐃緒申鐃淑みに￥申鐃叔随申鐃緒申 dnsmasq-2.75鐃叔実行わ申鐃緒申箸鐃緒申鐃淑器申鐃緒申鐃叔わ申(+ignore 鐃緒申弔鐃緒申襪鰹申箸如鐃�TCP鐃塾フワ申鐃緒申鐃緒申丱奪鐃緒申魑�わ申鐃緒申鐃淑わ申鐃処う鐃祝わ申鐃銃わ申鐃殉わ申鐃緒申
$ dig +dnssec hiv dnskey +ignore
; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.2 <<>> +dnssec hiv dnskey +ignore
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25086
;; flags: qr tc rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;hiv. IN DNSKEY
;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: 鐃渋行わ申鐃緒申鐃緒申鐃緒申
;; MSG SIZE rcvd: 32
鐃叔わ申鐃緒申鐃緒申TCP鐃祝フワ申鐃緒申鐃緒申丱奪鐃緒申鐃緒申鐃緒申鐃緒申
$ dig +dnssec hiv dnskey +short
;; Truncated, retrying in TCP mode.
256 3 7 AwEAAaaV7VJUrPL0rN5/eMz3l4v9ur0xPYz0+DWpioxK7hqSmsV18oGW Zq3mHfKH8fSAkaMIlmWvqT64m60hthhdW5YZC3GQ0HzI8mwAebEkiDuc WjKME3Lk3ktC0mhlTMWjsF8MwAF2cE+1CczLHeHWrgkR2Y5qPgd14fwo 474g2Nuf
257 3 7 AwEAAYM1Sl/orr8SqlvM6ShxKBdJMSOeD7HcTFP+TTDpVJpSHBhmAsMb 30JtMRo68dsG4rIBBpc69718m0j1l8zK1uNxoJx5UkfNWG0GoOp6EKur LkLTk3luzDNmj3jrgS4oz6ztb6QYsj0hnKgMA7HW335Cb14J+vSATDpj 79cnMa4h0Ik7pIufPmAYFmQWBZeOr+99QOdzqP5zX9j5nyOEbGv82+xD 4bcFstecZ6In8WdscwoglhXdPCY1ZEtbEGiIS21ENx+o2CWAaFHpiIua sjbYVQd6+HzNSBLagDx7+aRHqDCqux6ezHGw3wbVxkHB7OP1sAcRTJX+ 85rOjmXCJss=
257 3 7 AwEAAY/iJlahfRMvTBe89WI1KnkyOzhOapyM790ybtDXYd0Uf2C7T2VN DyMabc8mUaZA36F6aUpMmQW21SzoxtrJgzvJFgrxuhkU0reyczS/bOx7 lgH10VXdaFj2mDVeXJALl1P6JQ3gwMjD6O4+z/su2C6vrtIrSfexeI4o HWZxdMQ2Y123lq1nz1ZgIbJSWJOQbaFf3cZm1qETK4R8yEATgCfnZCQP rxb424FNsR8KgNsVNUevXDgbbzwVYY3y4dMqsDXMXj2pekJgzY2h2dAZ h50NvjXbWOcbcsurv5qEiY6lZ2F59KN6vn9zYiICE5c7BUbI6MgskRQ7 Ny53Oj4pMdk=
256 3 7 AwEAAa6bxHsMEnf15WewlIH4t8rtq2kFfk7XsOp78U+wRHfE5ycPx7WS hqNQ8lpcAQyEtob0GERdaaSA56pDVhBUt7FWgS0UKejhe/NUBEFXZ0J0 X2KzH25BNO0VFDutRbk9lbcv3jO9Is//mxRdFm3qQbdSXjyh7AGRWs/9 Bi8EhXBcX/bFnfdQDw6K5dsJTCzF5cp2+dUQ79ZAGlVacURkvvIPXd8N TJfuOgdNArXKbnEvUATuxwPM3rtnjWNTMIl5ONk5kn24eCpjyfzrOVVb KxvvhetNN9znv4xlZIQaLw+ybPfz4BgbKKwDjQr62H4E0fSyqRCBONaa 9sN+5TwV/i8=
256 3 7 AwEAAW+TjE1zmCMfjLHfwz0OlPh4daGbN50xIEFsXRmlPNQN8pVJHIpf 7NMooeg9yUj607O3cMN/T2I8TL2cjqOL+eLvepNc3Fp+J2ohlEI6tHmL C5mTZkU1xGD7myygnX/XelU7eAaHNdIkghRuzo3KSg0zvCBSeslCON4H 0xDYWYEr
257 3 7 AwEAAbwvxlNQlQoVmdOKIA6Mb3EpOCXFZicDnNEAkAz3I7xHmOm3kCbf Z/w2vY9VMiTLBafXqjFVgxH33+fKlOKL0gR5iwTLC6W3boH8up1icAZp X2wMcYhS2Mauj/MGBUtQokXoBuM758K7+rq2r3Or9KX5fHYbk6bNi8cH 6ThCWcmXEptAb1vLjYaIyJtj6IYjnkt0LOrUUOCDrj+oOkYXXvUX1ZP3 kVvS677Ch00jjDQuooTQ+l/AgI2cU7wIl2peTu/ZnaFzFVsvzD2vTD0d g0lzwMCa78smO/WLJpTtmptbPnK8ct1QdWbquALlrQ51bOOrjVaU32KU uAws7EgLnnE=
DNSKEY 7 1 86400 20160319061524 20160218061524 43515 hiv. odss/n3ue7l0Omba5suryXMZoRZiLZ9Qhq6Nv/az/y4HvrSqpRiB69XD /lVQGjKf44iNFtoxaL+K8qZxvDvHrWwVGpvGZjG8utB9Qhs0kaUUKnkT fbz1PamWT5BSvG6gSB2JSsN2BKlwBSuo8yQfgXNSNjO3Hf+mEVWzOB5i z6GRRohA9YjwdsRV3ZHqQMVhzCN3wTEH5fNg+cVunr41Kenx/glMOyjc nJseFXEiZJo3J3ejzerswYWMUcqjf62Yo81Kv47SLVa6pHHuUjA58Fhp z2btvLHy77YKOViYMzBIuiNluShjcnWJTWkeUGGZ4hpYE8dYYq4529VE wLLRMw==
DNSKEY 7 1 86400 20160319061524 20160218061524 56208 hiv. JtWLdWOmsDvis1P4kZad+CafHR/bLnY1u4vMe4ytqmOrvftqGidv3CYw n7cff13fusjBdnuoHpT/JP0NIpPg/W6gkNyF1iwLCAzFwFCYjb8mtOIc bWOYuJTdtY/aO0XngVr0QDTOLEUfns5NcXsqu82Ne40VOAhm+zo08CeY V66ex21CMgt33scYT9c8HzCloDn14ltAeG3aZcb9C7wCBOUnmRYvFDZZ t1eLsGBER+2pScQlhXTsx/+gmDphCULzvjoRUCzWw3gQ4+Bfk3AiLIqn aaSIJSLRhr+5Ak0XoVKCtYFaVhk9fyd2U7YGAUlF0pbng+WMGbe1KY2k QX4gGw==
鐃塾よう鐃祝￥申鐃緒申鐃縮わ申鐃緒申鐃渋わ申鐃銃わ申鐃緒申呂鐃緒申鐃�1280鐃出ワ申鐃夙わ申曚鐃緒申鐃曙ス鐃楯ンスわ申鐃緒申鐃緒申鐃獣てわ申鐃殉ってわ申鐃殉わ申鐃緒申鐃淑ので￥申鐃緒申鐃渋削申鐃夙わ申鐃銃わ申鐃峻緒申分鐃緒申鐃緒申覆鐃緒申任鐃緒申腓�鐃緒申鐃緒申(鐃瞬逸申辰討鐃緒申鐃緒申鐃緒申摘鐃所い鐃殉わ申鐃緒申鐃緒申鐃淑みわ申TCP鐃淑ので関件申鐃熟なわ申鐃緒申任鐃緒申鐃叔逸申里鐃緒申鐃� edns-packet-max 鐃緒申鐃緒申鐃所し鐃銃みまわ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申任鐃緒申鐃緒申鐃�
鐃緒申鐃緒申鐃緒申鐃�UDP鐃緒申TCP鐃夙わ申鐃緒申鐃緒申造鐃緒申櫃鐃緒申鐃緒申鐃緒申里鬚�使わ申鐃淑わ申个鐃緒申鐃叔わ申鐃緒申鐃夙は思わ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃叔なわ申鐃緒申鐃� workaround 鐃緒申鐃緒申鐃緒申董鐃緒申諜鐃重�速鐃巡か鐃祝鰹申鐃緒申鐃術ッワ申鐃緒申鐃緒申鐃薯アップデ￥申鐃夙わ申鐃暑こ鐃夙をお器申鐃潤し鐃殉わ申鐃緒申
鐃緒申鐃夙￥申iptables/ip6tables 鐃緒申鐃緒申鐃渋わ申櫃鐃緒申茲�鐃夙わ申鐃銃わ申鐃緒申鐃緒申鐃盾お鐃緒申鐃殉わ申鐃緒申鐃緒申UDP鐃熟わ申鐃緒申鐃緒申任鐃緒申鐃� TCP鐃緒申 MSS鐃叔ぶっわ申鐃准ってわ申鐃緒申鐃緒申覆里如鐃緒申僖鐃緒申奪鐃縦刻申念鐃緒申坦櫃鐃緒申茲�鐃夙わ申鐃銃も、鐃殉ッワ申鐃緒申鐃殉わ申鐃緒申任鐃緒申鐃緒申覆鐃緒申鐃熟誌申盖わ申佞鐃緒申鐃緒申鐃緒申椶鐃緒申鐃緒申鐃緒申剖鐃緒申鐃緒申討鐃緒申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申法鐃緒申覆里任鐃緒申鐃緒申鐃出縁申鐃夙わ申鐃銃わ申鐃峻緒申分鐃緒申鐃夙思わ申鐃殉わ申鐃緒申
鐃夙わ申鐃緒申鐃緒申鐃夙で￥申鐃重ねての件申鐃緒申鐃叔わ申鐃緒申鐃緒申鐃緒申鐃獣わ申鐃夙ワ申鐃獣プデ￥申鐃夙わ申鐃殉わ申鐃順う鐃縦￥申
鐃宿居申鐃緒申鐃塾ｏ申: 2016/02/18 18:15 JST
bind 鐃緒申 unbound 鐃緒申 max-udp-size 鐃祝わ申鐃緒申鐃緒申造癲�鐃緒申鐃竣ワ申鐃緒申鐃縮常申鐃緒申鐃粛わ申鐃銃も、UDP鐃緒申鐃緒申任鐃緒申鐃緒申鐃叔逸申覆鐃緒申蕁�鐃緒申鐃曙自鐃塾は実際に醐申鐃准わ申鐃殉わ申鐃緒申任鐃緒申鐃緒申鐃緒申鐃�TCP 鐃祝わ申無鐃熟のはわ申鐃叔わ申鐃緒申鐃緒申鐃緒申鐃� RedHat 鐃緒申鐃緒申鐃�
Critical security flaw: glibc stack-based buffer overflow in getaddrinfo() (CVE-2015-7547)
https://access.redhat.com/articles/2161461
鐃緒申鐃宿わ申鐃�
The TCP-based vector could be mitigated by a trusted recursive resolver
on a trusted network which limits the size of individual DNS responses to
1023 bytes and below. However, such a capability is not common in DNS resolver
implementations because it breaks the DNS protocol. (The buffer size
configuration option offered by most resolvers only applies to UDP, not TCP.)
Rejecting AAAA responses, without also limiting the size of A responses, does
not mitigate the vulnerability.
鐃夙わ申鐃緒申茲�鐃祝￥申鐃緒申呂鐃� TCP鐃舜わ申鐃出削申鐃祝はなわ申覆鐃緒申鐃夙書いてわ申鐃緒申泙鐃緒申鐃緒申鐃�
鐃宿居申鐃緒申鐃塾ｏ申鐃緒申 dnsmasq 鐃祝関わ申鐃緒申 dig 鐃塾ワ申鐃峻ペミワ申鐃緒申鐃緒申鐃獣わ申鐃塾で￥申直鐃緒申鐃殉わ申鐃緒申鐃緒申
鐃宿居申鐃緒申鐃塾ｏ申鐃緒申 2016/02/19 19:46 JST
IIJ鐃緒申鐃緒申鐃緒申楮戮焚鐃緒申鐃緒申鐃藷が出てわ申鐃殉わ申鐃緒申鐃緒申流鐃緒申IIJ鐃緒申鐃緒申任鐃緒申諭鐃�
CVE-2015-7547 glibc鐃祝わ申鐃緒申鐃緒申getaddrinfo鐃緒申鐃夙種申鐃緒申鐃祝つわ申鐃緒申
https://sect.iij.ad.jp/d/2016/02/197129.html
鐃緒申鐃緒申鐃夙�鐃緒申鐃緒申鐃緒申 Red Hat 鐃緒申鐃藷供わ申鐃緒申 https://t.co/nzEP6vHJ3d 鐃緒申 FAQ 2. Can a trusted recursive DNS resolver 鐃緒申鐃� 鐃夙異なわ申鐃緒申鐃緒申砲覆辰討鐃塾わ申鐃緒申鐃祝なわ申覆鐃� https://t.co/9fylO6Pnm6
— SODA Noriyuki (@n_soda) 2016, 2鐃緒申 19
@OrangeMorishita IIJ鐃塾人わ申鐃緒申鐃緒申Red Hat鐃緒申鐃盾深鐃緒申鐃粛わ申鐃銃わ申鐃叔緒申鐃緒申函鐃�Red Hat鐃塾人わ申IIJ鐃塾人の居申鐃重わ申鐃銃なわ申鐃緒申鐃緒申戰鐃緒申鐃緒申鐃緒申鐃緒申里辰討鐃緒申能鐃緒申鐃塾￥申両鐃緒申鐃緒申鐃緒申鐃緒申鐃叔わ申鐃緒申佑鐃緒申鐃�
— SODA Noriyuki (@n_soda) 2016, 2鐃緒申 19
鐃夙わ申鐃緒申鐃緒申念鐃緒申里鐃緒申傍鐃緒申砲覆鐃夙わ申鐃緒申鐃叔わ申鐃緒申鐃緒申IIJ鐃緒申鐃緒申旅融鐃緒申砲鐃緒申鐃緒申鐃緒申砲呂鐃緒申鐃緒申鐃叔種申鐃緒申鐃緒申鐃緒申鐃緒申箸鐃緒申鐃緒申任鐃緒申鐃�
悩鐃殉わ申鐃緒申鐃夙わ申鐃緒申鐃叔わ申鐃緒申鐃緒申鐃宿っわ申鐃緒申鐃緒申鐃緒申鐃緒申鐃銃わ申 glibc 鐃緒申紊駕申箸鐃緒申鐃緒申鐃緒申鐃淑わ申鐃塾で￥申鐃緒申辰僂鐃遵げ鐃銃わ申鐃緒申鐃緒申鐃夙をお器申鐃潤し鐃緒申鐃緒申鐃叔わ申鐃緒申
| IPv4/IPv6 meter |
鐃緒申鐃緒申鐃緒申鐃緒申鐃緒ー鐃宿わ申複鐃緒申鐃緒申鐃緒申任鐃緒申泙鐃�
| 鐃竣っわ申鐃緒申鐃渋わ申鐃縦…誌申鐃盾あ鐃暑、Amazon |
鐃緒申鐃銃ワ申鐃緒申
- Ajax (14)
- Amazon (1)
- Apache (28)
- Backup (4)
- Benchmark (5)
- Blog (3)
- Book (22)
- C (10)
- CGI (2)
- CPAN (8)
- CSS (2)
- Catalyst (8)
- CentOS (2)
- Chalow (11)
- CheatSheet (3)
- Computer (2)
- Crowi (1)
- DB (8)
- DBIC (10)
- DNS (6)
- Debian (31)
- Design (5)
- Django (9)
- Docker (7)
- Emacs (22)
- English (13)
- Excel (3)
- FileSystem (3)
- Firefox (19)
- Flash (2)
- Food (25)
- Framework (3)
- GTD (4)
- Gadget (6)
- Gmail (1)
- Google (19)
- HTML (2)
- Hacker (1)
- Health (22)
- Howto (5)
- IBM (3)
- IETF (2)
- IPv6 (45)
- JANOG (9)
- Java (8)
- Javascript (27)
- LDAP (4)
- Language (4)
- Life (4)
- Lifehack (3)
- Linix (1)
- Linux (127)
- Lisp (2)
- Mac (8)
- Mail (3)
- Manuscript (1)
- Monitoring (1)
- Munin (1)
- MySQL (23)
- Network (19)
- PHP (13)
- Perl (69)
- PostgreSQL (8)
- Programing (5)
- Python (42)
- RPM (1)
- RSS (4)
- React (1)
- RedHat (2)
- Regexp (3)
- Ruby (9)
- Samba (1)
- Scheme (3)
- Security (53)
- Server (4)
- Shell (6)
- Storage (6)
- Subversion (9)
- TAG (2)
- TIPS (26)
- TLS (1)
- Test (6)
- ThinkPad (9)
- Tomcat (3)
- Tools (18)
- Trac (9)
- Troubleshooting (2)
- Tuning (6)
- VMware (12)
- VPN (2)
- Vault (4)
- Vim (3)
- Vmware (5)
- VoIP (1)
- Vyatta (2)
- Web (28)
- WiFi (2)
- Wiki (3)
- Windows (10)
- XML (2)
- XSLT (1)
- Xen (2)
- XenServer (11)
- Zabbix (1)
- junoser (1)
- linkdraw (1)
- python (1)
- raspberry (2)
- skark (1)
- ssh (4)
- systemd (1)
- 鐃緒申鐃夙わ申鐃宿わ申 (5)
- 鐃緒申鐃緒申他 (67)
- 鐃緒申鐃緒申鐃� (29)
- 鐃緒申鐃緒申鐃殉ワ申 (24)
- 鐃緒申鐃駿ワ申鐃� (4)
- 鐃緒申鐃緒申鐃緒申 (1)
- 鐃緒申鐃夙リー鐃緒申 (2)
- 鐃緒申鐃殉ワ申謄鐃緒申奪鐃� (1)
- 鐃緒申鐃緒申鐃緒申鐃獣ワ申 (1)
- 鐃粛ワ申 (98)
- 鐃緒申鐃循駕申 (11)
- 鐃緒申発 (73)
- 鐃縦駈申 (3)
- 鐃緒申鐃緒申 (7)
- 鐃駿駕申 (5)
- 鐃緒申鐃緒申 (8)
- 鐃緒申鐃緒申 (3)
- 鐃緒申 (3)
- 鐃緒申物 (10)
- 鐃緒申鐃� (1)
- 文鐃緒申鐃緒申鐃緒申鐃緒申 (6)
- 鐃駿駈申鐃緒申 (1)