Bugtraq mailing list archives
Re: Permitting recursion can allow spammers to steal name server resources
From: "Dan Harkless" <bugtraq () harkless org>
Date: Wed, 10 Sep 2003 12:29:57 -0700
On September 9, 2003, Chris Brenton <cbrenton () chrisbrenton org> wrote: [...]
"DNS Cache Poisoning - The Next Generation" by by Joe Stewart, GCIH http://www.securityfocus.com/guest/17905
[...]
_Fixing the problem with Bind_
You aren't making any distinction between different versions of BIND, but you probably should be. The traditional easy cache poisoning attack using extra records in the "ADDITIONAL" section is resisted by BIND 9, but BIND 4 and 8 are still vulnerable, IIRC. Against BIND 9 you'd have to use address, port, and transaction ID spoofing, as Joe Stewart discusses in his article, which raises the bar for entry quite a bit.
Changing Bind so that it will not act recursively for all hosts on the Internet is a relatively simple process. Edit the /etc/named.conf file to add in the "allow-recursion" parameter similar to the following: options { directory "/var/named"; allow-recursion {localnets; }; };
[...]
allow-recursion {172.16.1.1, 10.0.0.0/8, 192.168.1.0/24;};
As has been pointed out before, this still leaves you potentially open to cache poisoning if the attacker can spoof those addresses (and again, the attacker will need to be spoofing anyway, if attacking BIND 9). The safest setup is to run authoritative nameservers on separate machines (or at least IPs) from caching recursive servers, as discussed, e.g. here: http://cr.yp.to/djbdns/separation.html -- Dan Harkless bugtraq () harkless org http://harkless.org/dan/
Current thread:
- Permitting recursion can allow spammers to steal name server resources Chris Brenton (Sep 10)
- Re: Permitting recursion can allow spammers to steal name server resources Mark Johnston (Sep 10)
- Re: Permitting recursion can allow spammers to steal name server resources Greg A. Woods (Sep 10)
- Re: Permitting recursion can allow spammers to steal name server resources Dan Harkless (Sep 10)
- Re: Permitting recursion can allow spammers to steal name server resources Mike Hoskins (Sep 10)
- Re: Permitting recursion can allow spammers to steal name server resources Devin Nate (Sep 15)