Cache poisoning vulnerability found in BIND [LWN.net]

Cache poisoning vulnerability found in BIND

Posted Jul 26, 2007 3:30 UTC (Thu) by smoogen (subscriber, #97)
Parent article: Cache poisoning vulnerability found in BIND

I am not sure about the random source port for UDP transactions.. would it not require intervening firewalls to have a connection tracker that did DNS, and would need to be able to decode the UDP port coming back so that they were part of the transaction.

I would agree that either this attack or something similar might have been in use for a while. Looking over DNS traffic to our university servers.. there has been some stuff that has got the back fo the head going.. hmmm.

(Log in to post comments)

Cache poisoning vulnerability found in BIND

Posted Jul 26, 2007 4:49 UTC (Thu) by flewellyn (subscriber, #5047) [Link]

No, the only thing that would matter to the firewall is the destination port, which, since DNS is a
Well Known Service, is always the same. The source port for the querying machine could be
anything; unless the firewall is configured to block outgoing ports, which is just silly, the DNS
server can respond on any port. If the port in question is randomized for each query, it makes
no difference.

Cache poisoning vulnerability found in BIND

Posted Jul 26, 2007 14:36 UTC (Thu) by jond (subscriber, #37669) [Link]

Isn't relying on an unpredictable source port a bit like relying on the current PID as an unguessable number? I.e. couldn't an attacker just forge 65,000-odd UDP packets, one per possible source address?

Cache poisoning vulnerability found in BIND

Posted Jul 26, 2007 19:06 UTC (Thu) by flewellyn (subscriber, #5047) [Link]

Not in a time-sensitive exploit like this one. Remember, cache-poisoning only works if the attacker's phony DNS reply can reach the querying machine prior to the legitimate one.