Actions
Bug #17005
open
BIND View and Zone names allow invalid values
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:
Description
In the BIND package, Zone and View names are not validated and thus allow invalid values to be set. For example, a zone name such as ../../../../../../../tmp/badzone can potentially write a file outside the named directory. A similarly named view has the same issue.
These values should be limited to "hostname-like" values (hostnames, FQDNs, IP addresses) as that is generally what BIND expects here.
Updated by Jim Pingle about 22 hours ago
- Status changed from In Progress to Feedback
- % Done changed from 0 to 100
Fixed in pkg version 9.20_8
Actions