bugtraq - Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <17b0fcab0707241318q74b94b17r702c64799b23a6@mail.gmail.com>
Date: Tue, 24 Jul 2007 21:18:47 +0100
From: "Jamie Riden" <jamie.riden@...il.com>
To: bugtraq@...urityfocus.com
Subject: Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer)

On 24 Jul 2007 17:40:35 -0000, securityfocus@...workontap.com
<securityfocus@...workontap.com> wrote:
> I don't exactly see how this is new "News" since Zalewski's paper on TCP sequence number analysis (which included analysis of versions of BIND):
>
> http://lcamtuf.coredump.cx/newtcp/

That article does not deal with attacks on BIND's PRNG.

As far as I can tell, Joe Stewart extended Zalewski's TCP sequence
number analysis to BIND's transaction IDs - however I don't think
Stewart's paper "DNS Cache Poisoning – The Next Generation" (
www.lurhq.com/dnscache.pdf ) goes as far as the recent BIND advisory
here - http://www.isc.org/sw/bind/bind-security.php:

"The DNS query id generation is vulnerable to cryptographic analysis
which provides a 1 in 8 chance of guessing the next query id for 50%
of the query ids. This can be used to perform cache poisoning by an
attacker."

I don't think that Amit's attack has been described before.

cheers,
 Jamie
-- 
Jamie Riden / jamesr@...ope.com / jamie@...eynet.org.uk
UK Honeynet Project: http://www.ukhoneynet.org/