The Cost of Complexity: Different Vulnerabilities While Implementing the Same RFC
summary
Analysis of RFC 1035 message compression across diverse TCP/IP stacks finds widespread, concrete faults: invalid compression pointers that forward or loop and miscalculate uncompressed sizes, missing label/length checks causing OOB reads/writes, and randomization failures of transaction ID/port that make spoofing practical. About half of tested implementations show at least one bug. Deliverables include an information-draft, open-source code queries using the yarn query framework, updated Project Memoria fingerprinting, and IDS/pcap testcases; several vulnerabilities enable DoS and some combine to enable remote code execution.
AI-written summary · about
chapters (13)
- 0:00Intro
- 3:41Why look more closely at DNS?
- 5:36Domain Name System (DNS)
- 6:11DNS encoding and compression
- 7:5420 years of compression vulnerabilities
- 12:05New vulnerabilities
- 14:15Anti-Pattern #1
- 21:12Affected devices
- 23:08Again, the supply chain
- 27:32Better documentation
- 29:59Static analysis
- 30:40Device fingerprinting
- 32:45Intrusion detection
related talks
13mTCP-Fuzz: Detecting Memory and Semantic Bugs in TCP Stacks with Fuzzing
26mMobile Interconnect Threats: How Next-Gen Products May be Already Outdated
47mDenial of Service with a Fistful of Packets: Exploiting Algorithmic Complexity Vulnerabilities
50mFinding Vulnerabilities In iOS/MacOS Networking Code
35mRoute to Bugs: Analyzing the Security of BGP Message Parsing
27mWIFI-Important Remote Attack Surface: Threat is Expanding
46mThe Anatomy of Java Vulnerabilities
29mHow Protocol Gateways May Introduce More Problems than They Solve