CERT® Vulnerability Note VN-99-01The CERT Coordination Center publishes vulnerability notes to provide information about vulnerabilities to the user community. Because our understanding of the scope of a vulnerability may change, information that originally appears in vulnerability notes may later become part of an advisory. Vulnerability notes may also be updated from time to time.
Topic: Potential for false authentication in registry transactionsMonday, June 21, 1999
DescriptionInternet registries are entities that have authority to delegate specific portions of domain name and/or IP address space to other entities. In some parts of the world, a registry may also be referred to as a registrar or a network information center (NIC).
Registries typically maintain databases of information objects related to their allocation of domain name and IP address resources. Commonly used objects include the following:
Registries facilitate transactions to create, modify, and remove database objects. The access to modify or remove existing registry database objects is typically controlled by various authentication methods that attempt to verify the person requesting the change is authorized to make the change. Authentication methods vary by registry.
One commonly used method of transaction authentication is used with email-based transaction processing. This method attempts to match the email address of the requester to an email address associated with an existing database object. This authentication method is sometimes called "MAIL-FROM" authentication. Because it is possible to forge an email address when sending email, this authentication scheme is not considered secure, and can leave database objects vulnerable to unauthorized modification or deletion.
ImpactRegistry database objects that are protected only by email-address-based transaction authentication may be vulnerable to unauthorized modification or removal through the use of maliciously forged transaction requests.
The integrity of delegated name server information and host objects, if used, is critical to the expected operation of applications that rely on the domain name system. Unauthorized malicious alteration or removal of the registry objects for delegated name servers or hosts can lead to serious results such as denial of service, redirection of service, or compromise of trust relationships between networked systems.
Likewise, unauthorized malicious alteration of the registry objects for point of contact information can lead to resource hijacking and a compromise of trusted information used to authenticate registry transactions.
In the absence of secure transaction authentication, automated and manual registry transaction processes may be vulnerable to forged requests.
IntrusionsThe CERT/CC has received reports of registry objects protected by email-address-based transaction authentication being modified by unauthorized sources using forged transaction requests.
DefensesThe CERT/CC encourages the use of more secure mechanisms for authorization of registry transactions. These methods include
This document is available from: http://www.cert.org/vul_notes/VN-99-01.html
CERT/CC Contact Information
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.
We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from
If you prefer to use DES, please call the CERT hotline for more information.
Getting security information
CERT publications and other security information are available from our web site
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.
Conditions for use, disclaimers, and sponsorship information
Copyright 1999 Carnegie Mellon University