Re: Major DNS vulnerability announced [CVE Question]

[Jonathan Smith <smithj () freethemallocs com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Steven M. Christey wrote:
> By the way, I'm treating Microsoft's "DNS Cache Poisoning Vulnerability"
> (CVE-2008-1454) as something that's Microsoft-specific, pending any
> further public details.  The bulletin doesn't seem to say anything about
> it being a general design problem.

BIND's advisory sounds suspiciously similar (indeed, until you sent this
email, I didn't even consider that they were different).

http://ftp.isc.org/isc/bind9/9.5.1b1/9.5.1b1 says "The method used makes
it harder to spoof answers to a resolver by expanding the range of UDP
ports from which queries are sent by the nameserver, thereby increasing
the variability of parameters in outgoing queries."

My reading of the above is that since a caching nameserver would
obviously cache responses received, spoofing an answer to a query is a
cache poisoning attack.

Note how similar this is to
http://www.microsoft.com/technet/security/bulletin/ms08-037.mspx. "The
security update addresses the vulnerabilities by... using random sockets
for UDP queries..."

But, really, I don't care. This mailing list is for FOSS software, and I
doubt Microsoft's DNS server qualifies ;-)

        smithj

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEAREIAAYFAkh0BaYACgkQCG91qXPaRel2owCePCG6ladJ+Jp3uHEgqQebEe79
2pcAnizEmlO1LSAsGCiKmWoHhQBswVfC
=3wnE
-----END PGP SIGNATURE-----