[SM-Security] [SMGLSA-2008-03] bind DNS cache poisoning vulnerabilities (CVE-2008-1447)
samuel at dragonboricua.net
Wed Jul 16 05:39:52 EDT 2008
A weakness in the DNS protocol may enable the poisoning of caching recurive
resolvers with spoofed data. DNSSEC is the only full solution. New versions
of BIND provide increased resilience to the attack.
BIND (Berkeley Internet Name Domain) is an implementation of the Domain
Name System (DNS) protocols and provides an openly redistributable
reference implementation of the major components of the Domain Name
* a Domain Name System server (named)
* a Domain Name System resolver library
* tools for verifying the proper operation of the DNS server
The BIND DNS Server is used on the vast majority of name serving
machines on the Internet, providing a robust and stable architecture on
top of which an organization's naming architecture can be built. The
resolver library included in the BIND distribution provides the standard
APIs for translation between domain names and Internet addresses and is
intended to be linked with applications requiring name service.
A vulnerability has been reported in ISC BIND, which can be exploited by
malicious people to poison the DNS cache.
The vulnerability is caused due to the DNS servers not sufficiently
randomizing the DNS query port number, which can be exploited to poison
the DNS cache.
The vulnerability is reported in all BIND 8 and 9 versions when running
as caching resolver.
These vulnerabilities were reported for all versions of bind prior to 9.5.0-P1,
9.4.2-P1 and 9.3.5-P1 running as a caching resolver. bind in all grimoires is
affected by this vulnerability.
bind has been updated in test, and will soon be in the stable grimoire. Please
note, that this only improves the resilience against this attack. Moreover, bind
still vulnerable to more elaborate attacks to poison the cache. The only way to
stop this is to use DNSSEC. Please read the ISC BIND security advisories
page for more information.
All bind users should upgrade to the latest available version:
# scribe update
# cast -c bind
If you maintain your own installation of bind ouside of sorcery, there are
patches available from upstream, please visit the bind-9.5.0-P1 release page
DNSSEC is the only definitive solution for this issue.
Elisamuel Resto <samuel at dragonboricua.net>
Source Mage General Guru / http://sourcemage.org
GPG ID: 18615F19/1024D / http://simplysam.us
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 197 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/sm-security/attachments/20080716/781f121c/attachment.bin
More information about the SM-Security