15 years later: remote code execution in qmail

Re:15 years later: remote code execution in qmail by dsl on Wednesday May 20, 2020 @03:29PM (#23250748)

DJB paid out $1,000 in 2009 to Matthew Dempsky for a djbdns security vulnerability.

https://marc.info/?l=djbdns&m=123613000920446&w=2

[ Parent | on HN ]

Re:15 years later: remote code execution in qmail by Quekid5 on Thursday May 21, 2020 @08:13AM (#23257460)

> The next release of djbdns will be backed by a new security guarantee.

I was a bit curious about this wording which seems quite weasel-wordy at first glance, so these are the snapshots of the page that have been saved by Archive here https://archive.vn/https://cr.yp.to/djbdns/guarantee.html

I did a rough diff of the two first saved snapshots (which span 2009), and got this:

    @@ -6,7 +6,7 @@
     
     The djbdns security guarantee
     
    -I offer $500 to the first person to publicly report a verifiable security hole in the latest version of djbdns.
    +I offer $1000 to the first person to publicly report a verifiable security hole in the latest version of djbdns.
     
    @@ -14,17 +14,25 @@
    -Bugs outside of djbdns, such as OS bugs or browser bugs, do not qualify. The vulnerability of DNS to forgery does not qualify. Denial-of-service attacks do not qualify. (An attacker can easily take down the Domain Name System, or selected parts of it; this is not news.)
    +Examples of problems that do not qualify:
    +
    +
    +
    +    Bugs outside of djbdns, such as OS bugs or browser bugs. (People could seize control of BIND 9.1 through an OpenSSL buffer overflow, but that was a bug in OpenSSL, not in BIND.)
    +
    +    The vulnerability of DNS to forgery. (BIND's port reuse makes blind forgery much less expensive, but this is a quantitative difference, not a qualitative difference. The DNS architecture needs cryptographic protection.)
    +
    +    Denial-of-service attacks. (BIND 9's fragility makes denial of service completely trivial; but an attacker can easily take down the Domain Name System without using any of BIND's bugs. The DNS architecture needs to be decentralized.)

I don't think this looks unreasonable in terms of actual consequences/definitions, but it is interesting how much effort and verbiage he spends on pointing out the flaws of other DNS servers.

[ Parent | on HN ]

Re:15 years later: remote code execution in qmail by davidu on Wednesday May 20, 2020 @04:47PM (#23251596)

I used to work with Matthew. He's next level smart, and very modest. We are very lucky he is a good hacker and not an evil hacker. :-)

[ Parent | on HN ]