Saint NAME:WRECK, Castaway of DNS

Patron of embedded TCP/IP stacks, compressed domain names, and devices nobody will ever update.

Life

On 13 April 2021 Forescout and JSOF, as part of Project Memoria, revealed NAME:WRECK: nine vulnerabilities in how four TCP/IP stacks (FreeBSD, Nucleus NET, NetX and IPnet) parsed DNS responses. What ran aground was the old compression of domain names, which saves bytes and gifts trouble. The researchers estimated over a hundred million devices involved, from servers to industrial systems.

Prayer

O Saint NAME:WRECK, who sinks ships by misreading a name, let our parsers count the pointers before following them. Amen.

How to celebrate

Celebrated by applying the FreeBSD, Siemens and Microsoft patches, and taking stock of the devices running a TCP/IP stack nobody knows anything about.

Mangle the name, sink the ship.