FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Gentoo > Gentoo User

 
 
LinkBack Thread Tools
 
Old 07-09-2008, 08:40 PM
7v5w7go9ub0o
 
Default DNS poisoning fix

Mick wrote:

Hi All,

Have you seen this?

http://uk.news.yahoo.com/afp/20080709/ttc-us-it-internet-software-crime-e0bba4a.html

and this?

http://www.doxpara.com/

Is it merely a matter of using the right version of bind (for those who run a
bind daemon locally), or does it go further than that?


This note from the author of maradns might help understand the issue.

(FWIW, maradns is straightforward and simple if you want to try it on an
interim basis 'til bind is fixed.)


"MaraDNS is immune to the new cache poisoning attack. MaraDNS has
always been immune to this attack. Ditto with Deadwood (indeed,
people can use MaraDNS or Deadwood on the loopback interface to
protect their machines from this attack).

OK, basically, this is an old problem DJB wrote about well over seven
years ago. The solution is to randomize both the query ID and the
source port; MaraDNS/Deadwood do this (and have been doing this since
around the time of their first public releases that could resolve DNS
queries) using a cryptographically strong random number generator
(MaraDNS uses an AES variant; Deadwood uses the 32-bit version of
Radio Gatun).

- Sam

--
gentoo-user@lists.gentoo.org mailing list
 
Old 07-10-2008, 08:58 AM
Adam Carter
 
Default DNS poisoning fix

> Is it merely a matter of using the right version of bind (for
> those who run a
> bind daemon locally), or does it go further than that?

"This issue is addressed in ISC BIND 9.2.8-P1, BIND 9.3.4-P1, BIND 9.4.1-P1 or BIND 9.5.0a6"

rix adam # emerge -pv bind

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild R ] net-dns/bind-9.4.1_p1 USE="berkdb ldap mysql* ssl threads -dlz -doc -idn -ipv6 -odbc -postgres -resolvconf (-selinux) -urandom" 0 kB

rix adam # ls -l /usr/sbin/named
-rwxr-xr-x 2 root root 347636 Aug 15 2007 /usr/sbin/named

So AFAICT it was fixed in stable/x86 around 11 months ago.
--
gentoo-user@lists.gentoo.org mailing list
 
Old 07-10-2008, 09:07 AM
Adam Carter
 
Default DNS poisoning fix

> So AFAICT it was fixed in stable/x86 around 11 months ago.

Ignore my earlier idoicy - from ISC's site;

"YOU ARE ADVISED TO INSTALL EITHER THE PATCHES (9.5.0-P1, 9.4.2-P1, 9.3.5-P1) OR THE NEW BETA RELEASES (9.5.1b1, 9.4.3b2) IMMEDIATELY.

The patches will have a noticeable impact on the performance of BIND caching resolvers with query rates at or above 10,000 queries per second. The beta releases include optimized code that will reduce the impact in performance to non-significant levels. "

http://www.isc.org/index.pl?/sw/bind/bind-security.php
--
gentoo-user@lists.gentoo.org mailing list
 
Old 07-10-2008, 01:35 PM
Dave Oxley
 
Default DNS poisoning fix

I've installed 9.4.2-P1 but http://www.doxpara.com/ says I'm still
vulnerable. What more do I need to do?


Cheers,
Dave.

Mick wrote:

Hi All,

Have you seen this?

http://uk.news.yahoo.com/afp/20080709/ttc-us-it-internet-software-crime-e0bba4a.html

and this?

http://www.doxpara.com/

Is it merely a matter of using the right version of bind (for those who run a
bind daemon locally), or does it go further than that?


--
gentoo-user@lists.gentoo.org mailing list
 
Old 07-10-2008, 01:50 PM
"Dirk Uys"
 
Default DNS poisoning fix

On Thu, Jul 10, 2008 at 3:35 PM, Dave Oxley <dave@daveoxley.co.uk> wrote:
> I've installed 9.4.2-P1 but http://www.doxpara.com/ says I'm still
> vulnerable. What more do I need to do?
>
> Cheers,
> Dave.
>
> Mick wrote:
>>
>> Hi All,
>>
>> Have you seen this?
>>
>>
>> http://uk.news.yahoo.com/afp/20080709/ttc-us-it-internet-software-crime-e0bba4a.html
>>
>> and this?
>>
>> http://www.doxpara.com/
>>
>> Is it merely a matter of using the right version of bind (for those who
>> run a bind daemon locally), or does it go further than that?
>>
>
> --
> gentoo-user@lists.gentoo.org mailing list
>
>

I think if your DNS server forwards a DNS query to any other server
that is not yet patched, you are still vulnerable.

Complain to your ISP or forward DNS requests to different name servers.

Hope this helps
Dirk
--
gentoo-user@lists.gentoo.org mailing list
 
Old 07-10-2008, 02:16 PM
Volker Armin Hemmann
 
Default DNS poisoning fix

On Donnerstag, 10. Juli 2008, Dave Oxley wrote:
> I've installed 9.4.2-P1 but http://www.doxpara.com/ says I'm still
> vulnerable. What more do I need to do?

you need to install the updated tools to. Client and server side have to be
fixed. Also the DNS your DNS is using has to be fixed. And finally, is that
'your' DNS or your ISPs DNS the site is showing.

--
gentoo-user@lists.gentoo.org mailing list
 
Old 07-10-2008, 05:01 PM
Josh Cepek
 
Default DNS poisoning fix

Dave Oxley wrote:
I've installed 9.4.2-P1 but http://www.doxpara.com/ says I'm still
vulnerable. What more do I need to do?


Cheers,
Dave.

Mick wrote:

Hi All,

Have you seen this?

http://uk.news.yahoo.com/afp/20080709/ttc-us-it-internet-software-crime-e0bba4a.html



and this?

http://www.doxpara.com/

Is it merely a matter of using the right version of bind (for those
who run a bind daemon locally), or does it go further than that?


Be sure you restart the BIND server after updating too, otherwise it
will happily continue to use the old version. "/etc/init.d/named
restart" should do it.


--
Josh
 
Old 07-10-2008, 08:00 PM
Alan McKinnon
 
Default DNS poisoning fix

On Thursday 10 July 2008, Josh Cepek wrote:
> Be sure you restart the BIND server after updating too, otherwise it
> will happily continue to use the old version. *"/etc/init.d/named
> restart" should do it.

make that:

killall named <repeat till certified dead> ; /etc/init.d/named start

named is notorious for not restarting properly on linux. It looks like
it restarted, no console messages to catch your eye and top shows it
running. The logs however say otherwise.

--
Alan McKinnon
alan dot mckinnon at gmail dot com

--
gentoo-user@lists.gentoo.org mailing list
 
Old 07-11-2008, 02:30 PM
Dave Oxley
 
Default DNS poisoning fix

I restarted bind (had to do a killall) and I had updated tools and it
still didn't work. It was my IP address that showed up on the site. But
today it started working and now says I'm safe although I hadn't
changed anything since. Don't know what the answer was but at least
it's ok now.



Cheers,

Dave.



Volker Armin Hemmann wrote:

On Donnerstag, 10. Juli 2008, Dave Oxley wrote:


I've installed 9.4.2-P1 but http://www.doxpara.com/ says I'm still
vulnerable. What more do I need to do?



you need to install the updated tools to. Client and server side have to be
fixed. Also the DNS your DNS is using has to be fixed. And finally, is that
'your' DNS or your ISPs DNS the site is showing.





--
gentoo-user@lists.gentoo.org mailing list
 

Thread Tools




All times are GMT. The time now is 04:52 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org