oss-security - Re: Major DNS vulnerability announced [CVE Question]

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Wed, 09 Jul 2008 14:46:57 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: Major DNS vulnerability announced  [CVE Question]

* Steven M. Christey:

> Based on my current read of things (perhaps faulty, and definitely without
> all the relevant details), CVE-2008-1447 is for a fundamental design
> problem with DNS itself, so it applies to all implementations (or "most,"
> according to CERT... I'm afraid to ask the followup question).

I guess you should label this as the "workaround for the Kaminsky DNS
thing" for now.  Source port randomization does not actually fix
anything.  It just shifts the statistics a bit (enough to be comfortable
with for the coming months/weeks, but surely not in the long term).

When the actual attack vectors become public knowledge, it might make
sense to split the CVE along them because some of them can be addressed
by code changes, and some are a bit more difficult to protect against.
In short, this has "DNSSEC" written all over it.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.