BugTraq
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Jul 24 2007 05:40PM
securityfocus networkontap com (2 replies)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Jul 24 2007 08:18PM
Jamie Riden (jamie riden gmail com) (2 replies)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Jul 27 2007 04:40AM
Gadi Evron (ge linuxbox org) (2 replies)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Jul 27 2007 07:19PM
Amit Klein (aksecurity gmail com) (1 replies)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Jul 27 2007 06:54PM
Tim Newsham (newsham lava net) (1 replies)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Jul 27 2007 10:34PM
Amit Klein (aksecurity gmail com)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Jul 27 2007 04:37PM
Tim (tim-security sentinelchicken org)
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Jul 26 2007 10:50PM
Theo de Raadt (deraadt cvs openbsd org)
> On 24 Jul 2007 17:40:35 -0000, securityfocus (at) networkontap (dot) com [email concealed]
> <securityfocus (at) networkontap (dot) com [email concealed]> wrote:
> > I don't exactly see how this is new "News" since Zalewski's paper on TCP =
> sequence number analysis (which included analysis of versions of BIND):
> >
> > http://lcamtuf.coredump.cx/newtcp/
>
> That article does not deal with attacks on BIND's PRNG.
>
> As far as I can tell, Joe Stewart extended Zalewski's TCP sequence
> number analysis to BIND's transaction IDs - however I don't think
> Stewart's paper "DNS Cache Poisoning =96 The Next Generation" (
> www.lurhq.com/dnscache.pdf ) goes as far as the recent BIND advisory
> here - http://www.isc.org/sw/bind/bind-security.php:
>
> "The DNS query id generation is vulnerable to cryptographic analysis
> which provides a 1 in 8 chance of guessing the next query id for 50%
> of the query ids. This can be used to perform cache poisoning by an
> attacker."
>
> I don't think that Amit's attack has been described before.

The problem comes from ISC writing an incomplete solution to a problem
initially described in 1997 (and solved, I might add).

http://www.openbsd.org/advisories/res_random.txt

Before 1997, the attack was even easier -- take Amit's attack and
delete all the complicated math and replace it with id++.

Amit just shows that ISC ignored a better solution; that of using
a LCG-based generator.

[ reply ]
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Jul 24 2007 08:07PM
Amit Klein (aksecurity gmail com)


 

Privacy Statement
Copyright 2010, SecurityFocus