[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CACYkhxh3X6bLGr61eqY78+C_da3u-=zD_FPp667ghzQU5CcGKQ@mail.gmail.com>
Date: Wed, 12 Feb 2014 10:13:57 +1100
From: Michael Samuel <mik@...net.net>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request New-djbdns: dnscache: potential cache poisoning
On 12 February 2014 00:05, P J P <ppandit@...hat.com> wrote:
> | The security flaw is in the DNS protocol, and (apart from protocol
> upgrade
> | fantasies) the only practical way to mitigate this is to have a pool of
> IP
> | addresses to initiate recursive requests from.
>
> That is accept requests from predefined networks? djbdns/ndjbdns already
> does
> that. Still, that network could be very large. There are also open
> resolvers.
That helps too (assuming no malware outbreak), but I was referring to
having a pool
of IP addresses attached to the DNS server for the purpose of sending
outbound
requests, in order to multiply the number of available address+port+ID sets.
> Hmmn..true; DNS is suppose to recycle cached records. But does that mean
> all
> DNS implementations are vulnerable to cache poisoning? (given enough
> efforts)
Yes. That effort isn't necessarily trivial, but as bandwidth and CPU
resources
increase, these attacks become easier and less overt. If the attacker is
able to sniff
the DNS traffic before it reaches the target server, it's game over no
matter how big
a space of ports/IDs you have.
Regards,
Michael
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
