Date: Wed, 09 Jul 2008 14:46:57 +0200 From: Florian Weimer <fw@...eb.enyo.de> To: oss-security@...ts.openwall.com Subject: Re: Major DNS vulnerability announced [CVE Question] * Steven M. Christey: > Based on my current read of things (perhaps faulty, and definitely without > all the relevant details), CVE-2008-1447 is for a fundamental design > problem with DNS itself, so it applies to all implementations (or "most," > according to CERT... I'm afraid to ask the followup question). I guess you should label this as the "workaround for the Kaminsky DNS thing" for now. Source port randomization does not actually fix anything. It just shifts the statistics a bit (enough to be comfortable with for the coming months/weeks, but surely not in the long term). When the actual attack vectors become public knowledge, it might make sense to split the CVE along them because some of them can be addressed by code changes, and some are a bit more difficult to protect against. In short, this has "DNSSEC" written all over it.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.