bugtraq - Re: Permitting recursion can allow spammers to steal name server resources

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200309101929.h8AJTvLq017076@www.harkless.org>
Date: Wed, 10 Sep 2003 12:29:57 -0700
From: "Dan Harkless" <bugtraq@...kless.org>
To: bugtraq@...urityfocus.com
Subject: Re: Permitting recursion can allow spammers to steal name server resources

On September 9, 2003, Chris Brenton <cbrenton@...isbrenton.org> wrote:
[...]
> "DNS Cache Poisoning - The Next Generation" by by Joe Stewart, GCIH
> http://www.securityfocus.com/guest/17905
[...]
> _Fixing the problem with Bind_

You aren't making any distinction between different versions of BIND, but
you probably should be.  The traditional easy cache poisoning attack using
extra records in the "ADDITIONAL" section is resisted by BIND 9, but BIND 4
and 8 are still vulnerable, IIRC.  Against BIND 9 you'd have to use address,
port, and transaction ID spoofing, as Joe Stewart discusses in his article,
which raises the bar for entry quite a bit.

> Changing Bind so that it will not act recursively for all hosts on the 
> Internet is a relatively simple process. Edit the /etc/named.conf file 
> to add in the "allow-recursion" parameter similar to the following:
> 
> options {
>          directory "/var/named";
>          allow-recursion {localnets; };
> };
[...]
> allow-recursion {172.16.1.1, 10.0.0.0/8, 192.168.1.0/24;};

As has been pointed out before, this still leaves you potentially open to
cache poisoning if the attacker can spoof those addresses (and again, the
attacker will need to be spoofing anyway, if attacking BIND 9).

The safest setup is to run authoritative nameservers on separate machines
(or at least IPs) from caching recursive servers, as discussed, e.g. here:

    http://cr.yp.to/djbdns/separation.html

--
Dan Harkless
bugtraq@...kless.org
http://harkless.org/dan/