Security bugs are reported here via bugzilla

[Elisamuel Resto <samuel AT dragonboricua.net>]

Synopsis
========
A weakness in the DNS protocol may enable the poisoning of caching recurive
resolvers with spoofed data[0]. DNSSEC is the only full solution. New versions
of BIND provide increased resilience to the attack.

Background
==========
BIND (Berkeley Internet Name Domain) is an implementation of the Domain
Name System (DNS) protocols and provides an openly redistributable
reference implementation of the major components of the Domain Name
System, including:
    * a Domain Name System server (named)
    * a Domain Name System resolver library
    * tools for verifying the proper operation of the DNS server

The BIND DNS Server is used on the vast majority of name serving
machines on the Internet, providing a robust and stable architecture on
top of which an organization's naming architecture can be built. The
resolver library included in the BIND distribution provides the standard
APIs for translation between domain names and Internet addresses and is
intended to be linked with applications requiring name service.

Description
===========
CVE-2008-1447:
A vulnerability has been reported in ISC BIND[1], which can be exploited by
malicious people to poison the DNS cache.

The vulnerability is caused due to the DNS servers not sufficiently
randomizing the DNS query port number, which can be exploited to poison
the DNS cache.

The vulnerability is reported in all BIND 8 and 9 versions when running
as caching resolver.

Affected packages
=================
These vulnerabilities were reported for all versions of bind prior to 
9.5.0-P1,
9.4.2-P1 and 9.3.5-P1 running as a caching resolver. bind in all grimoires is
affected by this vulnerability.

bind has been updated in test, and will soon be in the stable grimoire. Please
note, that this only improves the resilience against this attack. Moreover, 
bind
still vulnerable to more elaborate attacks to poison the cache. The only way 
to
stop this is to use DNSSEC. Please read the ISC BIND security advisories[1]
page for more information.

Resolution
==========
All bind users should upgrade to the latest available version:
# scribe update
# cast -c bind

If you maintain your own installation of bind ouside of sorcery, there are 
patches available from upstream, please visit the bind-9.5.0-P1 release 
page[2]
for information.

DNSSEC is the only definitive solution for this issue[1].

References
==========
[0] http://secunia.com/advisories/30973/
[1] http://www.isc.org/sw/bind/bind-security.php
[2] http://www.isc.org/sw/bind/view/?release=9.5.0-P1


-- 
Elisamuel Resto <samuel AT dragonboricua.net>
Source Mage General Guru / http://sourcemage.org
GPG ID: 18615F19/1024D   / http://simplysam.us

Attachment: signature.asc
Description: PGP signature