Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer)

From: Tim <tim-security@sentinelchicken.org>
To: Gadi Evron <ge@linuxbox.org>
Cc: bugtraq@securityfocus.com
Subject: Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer)
Date:


On Thu, Jul 26, 2007 at 11:40:55PM -0500, Gadi Evron wrote:
> This is Paul Vixie's response on this, when I asked him for verification:
> 
> -----
> this bug has been reported over and over again for a dozen years.  it's
> odd to have to keep fixing it-- i fixed it in bind4 and bind8 when theo
> de raadt offered me his random number generator to use.  bind9 should've
> used that same one but apparently didn't.  note that with this fix, the
> difficulty in poisoning someone's cache rises from "a few tens of seconds"
> to "a few minutes".  it's a 16-bit field.  not a lot of room for
> randomness or unpredictability.  only DNSSEC, a protocol change, fixes
> this problem, which is fundamentally a protocol problem.  but since folks
> just won't leave it alone and keep on reporting it year after decade, we
> will keep on improving our random number generator for this dinky little
> 16-bit field.  i just wish the reporters wouldn't be so smarmy and self
> congradulatory about it.  it's not like this hasn't been reported, and
> fixed, many times by many others.
> -----


Note that this conveniently ignores the option to use randomized port
numbers...  No, it is a pretty fix, but it sure does help.

tim





Copyright © 1995-2020 LinuxRocket.net. All rights reserved.