Is it merely a matter of using the right version of bind (for those who run a
bind daemon locally), or does it go further than that?
This note from the author of maradns might help understand the issue.
(FWIW, maradns is straightforward and simple if you want to try it on an
interim basis 'til bind is fixed.)
"MaraDNS is immune to the new cache poisoning attack. MaraDNS has
always been immune to this attack. Ditto with Deadwood (indeed,
people can use MaraDNS or Deadwood on the loopback interface to
protect their machines from this attack).
OK, basically, this is an old problem DJB wrote about well over seven
years ago. The solution is to randomize both the query ID and the
source port; MaraDNS/Deadwood do this (and have been doing this since
around the time of their first public releases that could resolve DNS
queries) using a cryptographically strong random number generator
(MaraDNS uses an AES variant; Deadwood uses the 32-bit version of
Radio Gatun).
- Sam
--
gentoo-user@lists.gentoo.org mailing list
07-10-2008, 08:58 AM
Adam Carter
DNS poisoning fix
> Is it merely a matter of using the right version of bind (for
> those who run a
> bind daemon locally), or does it go further than that?
"This issue is addressed in ISC BIND 9.2.8-P1, BIND 9.3.4-P1, BIND 9.4.1-P1 or BIND 9.5.0a6"
rix adam # emerge -pv bind
These are the packages that would be merged, in order:
rix adam # ls -l /usr/sbin/named
-rwxr-xr-x 2 root root 347636 Aug 15 2007 /usr/sbin/named
So AFAICT it was fixed in stable/x86 around 11 months ago.
--
gentoo-user@lists.gentoo.org mailing list
07-10-2008, 09:07 AM
Adam Carter
DNS poisoning fix
> So AFAICT it was fixed in stable/x86 around 11 months ago.
Ignore my earlier idoicy - from ISC's site;
"YOU ARE ADVISED TO INSTALL EITHER THE PATCHES (9.5.0-P1, 9.4.2-P1, 9.3.5-P1) OR THE NEW BETA RELEASES (9.5.1b1, 9.4.3b2) IMMEDIATELY.
The patches will have a noticeable impact on the performance of BIND caching resolvers with query rates at or above 10,000 queries per second. The beta releases include optimized code that will reduce the impact in performance to non-significant levels. "
http://www.isc.org/index.pl?/sw/bind/bind-security.php
--
gentoo-user@lists.gentoo.org mailing list
07-10-2008, 01:35 PM
Dave Oxley
DNS poisoning fix
I've installed 9.4.2-P1 but http://www.doxpara.com/ says I'm still
vulnerable. What more do I need to do?
Is it merely a matter of using the right version of bind (for those who run a
bind daemon locally), or does it go further than that?
--
gentoo-user@lists.gentoo.org mailing list
07-10-2008, 01:50 PM
"Dirk Uys"
DNS poisoning fix
On Thu, Jul 10, 2008 at 3:35 PM, Dave Oxley <dave@daveoxley.co.uk> wrote:
> I've installed 9.4.2-P1 but http://www.doxpara.com/ says I'm still
> vulnerable. What more do I need to do?
>
> Cheers,
> Dave.
>
> Mick wrote:
>>
>> Hi All,
>>
>> Have you seen this?
>>
>>
>> http://uk.news.yahoo.com/afp/20080709/ttc-us-it-internet-software-crime-e0bba4a.html
>>
>> and this?
>>
>> http://www.doxpara.com/
>>
>> Is it merely a matter of using the right version of bind (for those who
>> run a bind daemon locally), or does it go further than that?
>>
>
> --
> gentoo-user@lists.gentoo.org mailing list
>
>
I think if your DNS server forwards a DNS query to any other server
that is not yet patched, you are still vulnerable.
Complain to your ISP or forward DNS requests to different name servers.
Hope this helps
Dirk
--
gentoo-user@lists.gentoo.org mailing list
07-10-2008, 02:16 PM
Volker Armin Hemmann
DNS poisoning fix
On Donnerstag, 10. Juli 2008, Dave Oxley wrote:
> I've installed 9.4.2-P1 but http://www.doxpara.com/ says I'm still
> vulnerable. What more do I need to do?
you need to install the updated tools to. Client and server side have to be
fixed. Also the DNS your DNS is using has to be fixed. And finally, is that
'your' DNS or your ISPs DNS the site is showing.
--
gentoo-user@lists.gentoo.org mailing list
07-10-2008, 05:01 PM
Josh Cepek
DNS poisoning fix
Dave Oxley wrote:
I've installed 9.4.2-P1 but http://www.doxpara.com/ says I'm still
vulnerable. What more do I need to do?
Is it merely a matter of using the right version of bind (for those
who run a bind daemon locally), or does it go further than that?
Be sure you restart the BIND server after updating too, otherwise it
will happily continue to use the old version. "/etc/init.d/named
restart" should do it.
--
Josh
07-10-2008, 08:00 PM
Alan McKinnon
DNS poisoning fix
On Thursday 10 July 2008, Josh Cepek wrote:
> Be sure you restart the BIND server after updating too, otherwise it
> will happily continue to use the old version. *"/etc/init.d/named
> restart" should do it.
make that:
killall named <repeat till certified dead> ; /etc/init.d/named start
named is notorious for not restarting properly on linux. It looks like
it restarted, no console messages to catch your eye and top shows it
running. The logs however say otherwise.
--
Alan McKinnon
alan dot mckinnon at gmail dot com
--
gentoo-user@lists.gentoo.org mailing list
07-11-2008, 02:30 PM
Dave Oxley
DNS poisoning fix
I restarted bind (had to do a killall) and I had updated tools and it
still didn't work. It was my IP address that showed up on the site. But
today it started working and now says I'm safe although I hadn't
changed anything since. Don't know what the answer was but at least
it's ok now.
Cheers,
Dave.
Volker Armin Hemmann wrote:
On Donnerstag, 10. Juli 2008, Dave Oxley wrote:
I've installed 9.4.2-P1 but http://www.doxpara.com/ says I'm still
vulnerable. What more do I need to do?
you need to install the updated tools to. Client and server side have to be
fixed. Also the DNS your DNS is using has to be fixed. And finally, is that
'your' DNS or your ISPs DNS the site is showing.
DNS poisoning fix
