17 July 2008 1 views 2 Comments

Multiple DNS implementations vulnerable to cache poisoning

Deficiencies in the DNS protocol and common DNS implementations facilitate DNS cache poisoning attacks.

The Domain Name System (DNS) is responsible for translating host names to IP addresses (and vice versa) and is critical for the normal operation of internet-connected systems. DNS cache poisoning (sometimes referred to as cache pollution) is an attack technique that allows an attacker to introduce forged DNS information into the cache of a caching nameserver. DNS cache poisoning is not a new concept; in fact, there are published articles that describe a number of inherent deficiencies in the DNS protocol and defects in common DNS implementations that facilitate DNS cache poisoning. The following are examples of these deficiencies and defects:

• Insufficient transaction ID space
  The DNS protocol specification includes a transaction ID field of 16 bits. If the specification is correctly implemented and the transaction ID is randomly selected with a strong random number generator, an attacker will require, on average, 32,768 attempts to successfully predict the ID. Some flawed implementations may use a smaller number of bits for this transaction ID, meaning that fewer attempts will be needed. Furthermore, there are known errors with the randomness of transaction IDs that are generated by a number of implementations. Amit Klein researched several affected implementations in 2007. These vulnerabilities are described in the following vulnerability notes:
  • VU#484649 - Microsoft Windows DNS Server vulnerable to cache poisoning
  • VU#252735 - ISC BIND generates cryptographically weak DNS query IDs
  • VU#927905 - BIND version 8 generates cryptographically weak DNS query identifiers
• Multiple outstanding requests
  Some implementations of DNS services contain a vulnerability in which multiple identical queries for the same resource record (RR) will generate multiple outstanding queries for that RR. This condition leads to the feasibility of a ‘birthday attack,’ which significantly raises an attacker’s chance of success. This problem was previously described in VU#457875. A number of vendors and implementations have already added mitigations to address this issue.
• Fixed source port for generating queries
  Some current implementations allocate an arbitrary port at startup (sometimes selected at random) and reuse this source port for all outgoing queries. In some implementations, the source port for outgoing queries is fixed at the traditional assigned DNS server port number, 53/udp.

More info

Related posts

• This DNS server is vulnerable! (0)
• Wine (Wine is not emulator) (2)
• Windows XP service pack 3 available to download. (0)
• Windows Server 2008 Released To Manufacturers; Customers And Partners Prepare For Deployment (0)
• Windows 7 to arrive next year, says Bill Gates (0)