Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: Permitting recursion can allow spammers to steal name server resources
From: "Dan Harkless" <bugtraq () harkless org>
Date: Wed, 10 Sep 2003 12:29:57 -0700


On September 9, 2003, Chris Brenton <cbrenton () chrisbrenton org> wrote:
[...]
"DNS Cache Poisoning - The Next Generation" by by Joe Stewart, GCIH
http://www.securityfocus.com/guest/17905
[...]
_Fixing the problem with Bind_

You aren't making any distinction between different versions of BIND, but
you probably should be.  The traditional easy cache poisoning attack using
extra records in the "ADDITIONAL" section is resisted by BIND 9, but BIND 4
and 8 are still vulnerable, IIRC.  Against BIND 9 you'd have to use address,
port, and transaction ID spoofing, as Joe Stewart discusses in his article,
which raises the bar for entry quite a bit.

Changing Bind so that it will not act recursively for all hosts on the 
Internet is a relatively simple process. Edit the /etc/named.conf file 
to add in the "allow-recursion" parameter similar to the following:

options {
         directory "/var/named";
         allow-recursion {localnets; };
};
[...]
allow-recursion {172.16.1.1, 10.0.0.0/8, 192.168.1.0/24;};

As has been pointed out before, this still leaves you potentially open to
cache poisoning if the attacker can spoof those addresses (and again, the
attacker will need to be spoofing anyway, if attacking BIND 9).

The safest setup is to run authoritative nameservers on separate machines
(or at least IPs) from caching recursive servers, as discussed, e.g. here:

    http://cr.yp.to/djbdns/separation.html

--
Dan Harkless
bugtraq () harkless org
http://harkless.org/dan/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]