Check if MiniDNS DNSSEC NSEC verification is affected by CVE-2018-1000002

[Flowdalic]

From http://www.openwall.com/lists/oss-security/2018/02/09/1

Announcement for Knot Resolver 1.5.2 is here:
https://lists.nic.cz/pipermail/knot-resolver-users/2018/000000.html

Nature of the issue is that original DNSSEC specification in dection 5.4
of [RFC4035] under-specifies the algorithm for checking nonexistence
proofs.

While implementing DNSSEC validation into Knot Resolver, we forgot to
implement additional conditions explained in RFC 6840, so our DNSSEC
validator could accept an NSEC or NSEC3 RR proofs from an ancestor zone
as proving the nonexistence of an RR in a child zone.

Please note that Knot Resolver versions older than latest 1.5.z are
obsolete and not maintained by CZ.NIC anymore so all users all advised
to upgrade immediatelly to to latests 1.5 or 2.0 branches.

Version 1.5.z is going to be end-of-life in approximatelly one month so
direct upgrade to version 2.0 or later is strongly recommended.

More links

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000002?cpeVersion=2.2
• https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html
• https://lists.nic.cz/pipermail/knot-dns-users/2018-January/001309.html
• https://lists.nic.cz/pipermail/knot-resolver-users/2018/000000.html