Re: Major DNS vulnerability announced [CVE Question]

[Florian Weimer <fw () deneb enyo de>]

* Steven M. Christey:

> Based on my current read of things (perhaps faulty, and definitely without
> all the relevant details), CVE-2008-1447 is for a fundamental design
> problem with DNS itself, so it applies to all implementations (or "most,"
> according to CERT... I'm afraid to ask the followup question).

I guess you should label this as the "workaround for the Kaminsky DNS
thing" for now.  Source port randomization does not actually fix
anything.  It just shifts the statistics a bit (enough to be comfortable
with for the coming months/weeks, but surely not in the long term).

When the actual attack vectors become public knowledge, it might make
sense to split the CVE along them because some of them can be addressed
by code changes, and some are a bit more difficult to protect against.
In short, this has "DNSSEC" written all over it.