Bugtraq mailing list archives
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer)
From: Tim <tim-security () sentinelchicken org>
Date: Fri, 27 Jul 2007 12:37:49 -0400
On Thu, Jul 26, 2007 at 11:40:55PM -0500, Gadi Evron wrote:
This is Paul Vixie's response on this, when I asked him for verification: ----- this bug has been reported over and over again for a dozen years. it's odd to have to keep fixing it-- i fixed it in bind4 and bind8 when theo de raadt offered me his random number generator to use. bind9 should've used that same one but apparently didn't. note that with this fix, the difficulty in poisoning someone's cache rises from "a few tens of seconds" to "a few minutes". it's a 16-bit field. not a lot of room for randomness or unpredictability. only DNSSEC, a protocol change, fixes this problem, which is fundamentally a protocol problem. but since folks just won't leave it alone and keep on reporting it year after decade, we will keep on improving our random number generator for this dinky little 16-bit field. i just wish the reporters wouldn't be so smarmy and self congradulatory about it. it's not like this hasn't been reported, and fixed, many times by many others. -----
Note that this conveniently ignores the option to use randomized port numbers... No, it is a pretty fix, but it sure does help. tim
Current thread:
- "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Amit Klein (Jul 24)
- <Possible follow-ups>
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) securityfocus (Jul 24)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Amit Klein (Jul 24)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Jamie Riden (Jul 26)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Theo de Raadt (Jul 27)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Gadi Evron (Jul 27)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Tim (Jul 27)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Amit Klein (Jul 27)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Tim Newsham (Jul 27)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Amit Klein (Jul 27)