|
BugTraq
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Jul 24 2007 05:40PM securityfocus networkontap com (2 replies) Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Jul 24 2007 08:07PM Amit Klein (aksecurity gmail com) |
|
|
Privacy Statement |
<securityfocus (at) networkontap (dot) com [email concealed]> wrote:
> I don't exactly see how this is new "News" since Zalewski's paper on TCP sequence number analysis (which included analysis of versions of BIND):
>
> http://lcamtuf.coredump.cx/newtcp/
That article does not deal with attacks on BIND's PRNG.
As far as I can tell, Joe Stewart extended Zalewski's TCP sequence
number analysis to BIND's transaction IDs - however I don't think
Stewart's paper "DNS Cache Poisoning ? The Next Generation" (
www.lurhq.com/dnscache.pdf ) goes as far as the recent BIND advisory
here - http://www.isc.org/sw/bind/bind-security.php:
"The DNS query id generation is vulnerable to cryptographic analysis
which provides a 1 in 8 chance of guessing the next query id for 50%
of the query ids. This can be used to perform cache poisoning by an
attacker."
I don't think that Amit's attack has been described before.
cheers,
Jamie
--
Jamie Riden / jamesr (at) europe (dot) com [email concealed] / jamie (at) honeynet.org (dot) uk [email concealed]
UK Honeynet Project: http://www.ukhoneynet.org/
[ reply ]