Re: CVE Request New-djbdns: dnscache: potential cache poisoning

[Michael Samuel <mik () miknet net>]

On 12 February 2014 00:05, P J P <ppandit () redhat com> wrote:

> | The security flaw is in the DNS protocol, and (apart from protocol
> upgrade
> | fantasies) the only practical way to mitigate this is to have a pool of
> IP
> | addresses to initiate recursive requests from.
>
>   That is accept requests from predefined networks? djbdns/ndjbdns already
> does
> that. Still, that network could be very large. There are also open
> resolvers.


That helps too (assuming no malware outbreak), but I was referring to
having a pool
of IP addresses attached to the DNS server for the purpose of sending
outbound
requests, in order to multiply the number of available address+port+ID sets.


>   Hmmn..true; DNS is suppose to recycle cached records. But does that mean
> all
> DNS implementations are vulnerable to cache poisoning? (given enough
> efforts)


Yes.  That effort isn't necessarily trivial, but as bandwidth and CPU
resources
increase, these attacks become easier and less overt.  If the attacker is
able to sniff
the DNS traffic before it reaches the target server, it's game over no
matter how big
a space of ports/IDs you have.

Regards,
  Michael