Internet Info 1997 December/Internet_Info_CD-ROM_Walnut_Creek_December_1997.iso/ietf/urn/urn-archives/urn-ietf.archive.9608/000038_owner-urn-ietf _Tue Aug 27 15:33:08 1996.msg

Internet Message Format | 1997-02-19 | 2KB

Received: (from daemon@localhost) by services.bunyip.com (8.6.10/8.6.9) id PAA23117 for urn-ietf-out; Tue, 27 Aug 1996 15:33:08 -0400
Received: from mocha.bunyip.com (mocha.Bunyip.Com [192.197.208.1]) by services.bunyip.com (8.6.10/8.6.9) with SMTP id PAA23112 for <[e-mail]>; Tue, 27 Aug 1996 15:33:06 -0400
Received: from gizmo.lut.ac.uk by mocha.bunyip.com with SMTP (5.65a/IDA-1.4.2b/CC-Guru-2b)
        id AA08177  (mail destined for [e-mail]); Tue, 27 Aug 96 15:33:03 -0400
Received: from mrrl.lut.ac.uk ([e-mail] [127.0.0.1]) by gizmo.lut.ac.uk (8.7.5/8.6.9) with ESMTP id UAA01372 for <[e-mail]>; Tue, 27 Aug 1996 20:33:01 +0100 (BST)
Message-Id: <[e-mail]>
To: [e-mail]
X-Uri: <URL:http://www.net.lut.ac.uk/~martin>
Subject: [URN] use of info gleaned from DNS
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Id: <[e-mail]>
Date: Tue, 27 Aug 1996 20:33:00 +0100
From: Martin Hamilton <[e-mail]>
Sender: [e-mail]
Precedence: bulk
Reply-To: Martin Hamilton <[e-mail]>
Errors-To: [e-mail]

I don't think there's any mention of this in the current NAPTR
draft, but it might be worth popping a note into the security
considerations section about the potential danger of using info
gotten from the DNS without any checking/santizing ?

e.g. don't just invoke a program using info from an NAPTR RR as
command line arguments, because there could be some nasty
characters lurking in there

Martin