[GH-ISSUE #3174] CVE-2017-15105: Use original owner names of NSEC records during validation #1150

New issue

Open

opened 2026-03-16 01:43:56 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:43:56 +03:00

Owner

Originally created by @divergentdave on GitHub (Aug 1, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3174

This vulnerability affected a lot of DNSSEC verifiers, and I think it likely affects us as well. See https://blog.nlnetlabs.nl/the-peculiar-case-of-nsec-processing-using-expanded-wildcard-records/. The gist is that RRSIG verification would allow the owner name of a wildcard NSEC record to be a synthesized name expanded from the wildcard name, and further NSEC verification used the attacker-controlled expanded name instead of the wildcard name that was originally signed. Unbound fixed this by rewriting NSEC record owner names before passing them on, since negative response validation only got passed the NSEC records, and not the RRSIG records. A similar approach would likely work for us.

Testing this would require providing crafted response messages, which will require more test infrastructure first.

Originally created by @divergentdave on GitHub (Aug 1, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3174 This vulnerability affected a lot of DNSSEC verifiers, and I think it likely affects us as well. See https://blog.nlnetlabs.nl/the-peculiar-case-of-nsec-processing-using-expanded-wildcard-records/. The gist is that RRSIG verification would allow the owner name of a wildcard NSEC record to be a synthesized name expanded from the wildcard name, and further NSEC verification used the attacker-controlled expanded name instead of the wildcard name that was originally signed. Unbound fixed this by rewriting NSEC record owner names before passing them on, since negative response validation only got passed the NSEC records, and not the RRSIG records. A similar approach would likely work for us. Testing this would require providing crafted response messages, which will require more test infrastructure first.