The peculiar case of NSEC processing using expanded wildcard records
We discovered a vulnerability in the processing of wildcard synthesized NSEC records. The result was Unbound, Google public DNS, PowerDNS and Dnsmasq contained a flaw that made it possible to downgrade secure connections. While synthesis of NSEC records is allowed by RFC 4592 , these synthesized owner names should not be used in the NSEC processing. This does, however, happen in Unbound 1.6.7 and earlier versions. Ralph Dolmans wrote a blog post about the discovery and findings.
| 정보원 | NLnet Labs |
|---|---|
| 수집 시각 | 2026. 10. 22. 오후 08:26 |
| 데이터 | Markdown JSON |
2018. 01. 30. 오전 08:00, NLnet Labs에서 "The peculiar case of NSEC processing using expanded wildcard records"을(를) 게시했습니다 (유형: 릴리스·공지). 관련 기술: Unbound, PowerDNS.