NetBSD Problem Report #59744

From www@netbsd.org  Sun Nov  2 02:43:26 2025
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 76C8E1A9239
	for <gnats-bugs@gnats.NetBSD.org>; Sun,  2 Nov 2025 02:43:26 +0000 (UTC)
Message-Id: <20251102024325.4B1B61A923C@mollari.NetBSD.org>
Date: Sun,  2 Nov 2025 02:43:25 +0000 (UTC)
From: brahimnewghazi@gmail.com
Reply-To: brahimnewghazi@gmail.com
To: gnats-bugs@NetBSD.org
Subject: Public AXFR Zone Transfer Issue
X-Send-Pr-Version: www-1.0

>Number:         59744
>Category:       security
>Synopsis:       Public AXFR Zone Transfer Issue
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    security-officer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 02 02:45:00 +0000 2025
>Originator:     Brahim Ghazi
>Release:        netbsd.org
>Organization:
Student
>Environment:
I found that the DNS servers for  netbsd.org allow AXFR zone transfers from the public internet. This means anyone can get the full DNS zone, including hostnames, MX/NS/A records, TXT tokens, and internal hostnames/IPs.
>Description:
Here’s what I did:

Found authoritative nameservers: dig +short NS  netbsd.org

Requested AXFR: dig @ns.netbsd.org netbsd.org AXFR                   it worked. 


And same for :
ns.global-wire.eu.
ns.netbsd.de.
ns.global-wire.fi.
ns.global-wire.net.


This issue is serious because it exposes internal infrastructure info, email setup, and can help attackers in phishing or subdomain attacks.

Please let me know how I can securely share the full findings.
>How-To-Repeat:
what?
>Fix:
Restrict DNS zone transfers so only authorized servers can request them.

Home	PR Database Search