[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <8763rfns1q.fsf@mid.deneb.enyo.de>
Date: Wed, 09 Jul 2008 14:46:57 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: Major DNS vulnerability announced [CVE Question]
* Steven M. Christey:
> Based on my current read of things (perhaps faulty, and definitely without
> all the relevant details), CVE-2008-1447 is for a fundamental design
> problem with DNS itself, so it applies to all implementations (or "most,"
> according to CERT... I'm afraid to ask the followup question).
I guess you should label this as the "workaround for the Kaminsky DNS
thing" for now. Source port randomization does not actually fix
anything. It just shifts the statistics a bit (enough to be comfortable
with for the coming months/weeks, but surely not in the long term).
When the actual attack vectors become public knowledge, it might make
sense to split the CVE along them because some of them can be addressed
by code changes, and some are a bit more difficult to protect against.
In short, this has "DNSSEC" written all over it.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
