Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Feb 2014 10:13:57 +1100
From: Michael Samuel <>
Subject: Re: CVE Request New-djbdns: dnscache: potential cache poisoning

On 12 February 2014 00:05, P J P <> wrote:

> | The security flaw is in the DNS protocol, and (apart from protocol
> upgrade
> | fantasies) the only practical way to mitigate this is to have a pool of
> IP
> | addresses to initiate recursive requests from.
>   That is accept requests from predefined networks? djbdns/ndjbdns already
> does
> that. Still, that network could be very large. There are also open
> resolvers.

That helps too (assuming no malware outbreak), but I was referring to
having a pool
of IP addresses attached to the DNS server for the purpose of sending
requests, in order to multiply the number of available address+port+ID sets.

>   Hmmn..true; DNS is suppose to recycle cached records. But does that mean
> all
> DNS implementations are vulnerable to cache poisoning? (given enough
> efforts)

Yes.  That effort isn't necessarily trivial, but as bandwidth and CPU
increase, these attacks become easier and less overt.  If the attacker is
able to sniff
the DNS traffic before it reaches the target server, it's game over no
matter how big
a space of ports/IDs you have.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.