bugtraq - Re: After 6 months - fix available for Microsoft DNS cache poisoning attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <482349F7.6070408@gmail.com>
Date: Thu, 08 May 2008 20:44:07 +0200
From: Amit Klein <aksecurity@...il.com>
To: rick.a.cook@...il.com
Cc: bugtraq@...urityfocus.com
Subject: Re: After 6 months - fix available for Microsoft DNS cache poisoning
 attack

rick.a.cook@...il.com wrote:
> After implementing this patch on a large scale network, it was discovered that this patch caused a dns memory leak. Microsoft has since corrected this issue with a private fix. 

Amusing. They pulled the fix from being released in October at the last 
minute, quoting memory leaks. I guess they didn't fully address it after 
all...

> Even worse, in my large enterprise, this patch caused the exact spoofing that it intended to prevent. Somehow the code to increase the entropy has caused random xid's to cross and spoof randomly, poisioning the cache through normal usage without the use of extracurricular programs. I've reported this to Microsoft and have been working with them in fixing this issue, which to date has not been fixed.
>   

Sounds like they just draw a random number each time, regardless of the 
history (i.e. of previously drawn numbers), which can cause collisions 
(I think that's the phenomenon you describe). BIND 9 has a mechanism 
that ensures that collisions are discarded. OpenBSD retains history of 
the last 32K (IIRC) numbers used, and does not re-use those numbers. 
PowerDNS randomizes UDP source ports, so it considerably reduces 
collision likelihood. I guess MS didn't implement any such mechanism (I 
don't know for sure because I never reviewed their solution - I didn't 
get a preview version from MS).

Thanks,
-Amit