nanog mailing list archives
Re: SANS: DNS Bug Now Public?
From: Joe Abley <jabley () ca afilias info>
Date: Wed, 23 Jul 2008 13:11:18 -0400
On 23 Jul 2008, at 12:16, Jorge Amodio wrote:
Let me add that folks need to understand that the "patch" is not a fix to aproblem that has been there for long time and it is just a workaround to reduce the chances for a potential attack, and it must be combined with best practices and recommendations to implent a more robust DNS setup.
Having just seen some enterprise types spend time patching their nameservers, it's also perhaps worth spelling out that "patch" in this case might require more than upgrading resolver code -- it could also involve reconfigurations, upgrades or replacements of NAT boxes too. If your NAT reassigns source ports in a predictable fashion, then no amount of BIND9 patching is going to help.
(Reconfiguring your internal resolvers to forward queries to an external, patched resolver which can see the world other than through NAT-coloured glasses may also be a way out.)
Joe
Current thread:
- SANS: DNS Bug Now Public? Jon Kibler (Jul 22)
- Re: SANS: DNS Bug Now Public? Christian Koch (Jul 22)
- Re: SANS: DNS Bug Now Public? Jorge Amodio (Jul 22)
- Re: SANS: DNS Bug Now Public? Steven M. Bellovin (Jul 23)
- Re: SANS: DNS Bug Now Public? Jorge Amodio (Jul 23)
- Re: SANS: DNS Bug Now Public? Joe Abley (Jul 23)
- Re: SANS: DNS Bug Now Public? Darren Bolding (Jul 23)
- Re: SANS: DNS Bug Now Public? Jasper Bryant-Greene (Jul 23)
- Re: SANS: DNS Bug Now Public? Phil Regnauld (Jul 24)
- Re: SANS: DNS Bug Now Public? Paul Vixie (Jul 24)
- Re: SANS: DNS Bug Now Public? Steven M. Bellovin (Jul 23)