Re: Multiple Vendor DNS Cache Poisoning issue

["Randal, Phil" <prandal () herefordshire gov uk>]

BIND users should check their configs to make sure they aren't
restricting the source port.

Any lines like

query-source port 53;
query-source-v6 port 53;

need to be commented out or deleted so that forwarded DNS queries come
from random ports.

RedHat have re-released their 5.x packages:

  http://rhn.redhat.com/errata/RHSA-2008-0533.html 

"[Updated 10th July 2008]
We have updated the Enterprise Linux 5 packages in this advisory. The
default and sample caching-nameserver configuration files have been
updated
so that they do not specify a fixed query-source port. Administrators
wishing to take advantage of randomized UDP source ports should check
their
configuration file to ensure they have not specified fixed query-source
ports."

Cheers,

Phil
-----Original Message-----
From: full-disclosure-bounces () lists grok org uk
[mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of
Chandrashekhar B
Sent: 10 July 2008 09:29
To: full-disclosure () lists grok org uk
Subject: [Full-disclosure] Multiple Vendor DNS Cache Poisoning issue

We have a detailed advisory here,

http://www.secpod.org/advisories/Multiple_Vendor_DNS_Spoofing_Vulnerabil
ity_MS08_037.html

Thanks,
Chandra.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/