bugtraq - Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <46AA72E5.30606@gmail.com>
Date: Sat, 28 Jul 2007 00:34:13 +0200
From: Amit Klein <aksecurity@...il.com>
To: Tim Newsham <newsham@...a.net>
Cc: Gadi Evron <ge@...uxbox.org>,
	Jamie Riden <jamie.riden@...il.com>, bugtraq@...urityfocus.com
Subject: Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer)

Tim Newsham wrote:
>> "it's not like this hasn't been reported, and fixed, many times by 
>> many others" - so if it's fixed so many times, how come it was still 
>> vulnerable, and ISC had to issue their patches?
>
> Because its just a 16-bit field.  DNS is broken.  Cache poisoning will 
> happen.  Those are the facts on the ground.  The only argument left
> is the degree of brokenness.

Perhaps. Even so, adding, as you (and many others) suggested previously, 
UDP source port (strong) randomization, in combination with strong 
transaction ID randomization would make poisoning way way harder than 
where it is today. Instead of 16 bits, you'd have ~30 bits of (strong) 
randomness. That's much better, and there's no reason I see why it can't 
be implemented today.