<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.16.3">
</HEAD>
<BODY>
<BR>
On Tue, 2008-07-22 at 13:45 -0700, David Wolfskill wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
<FONT COLOR="#000000">The FreeBSD lists have been fairly active recently in discussing the</FONT>
<FONT COLOR="#000000">(somewhat-)recently disclosed vulnerability in BIND that (IIRC) targets</FONT>
<FONT COLOR="#000000">recursive resolvers (by poisoning their caches).</FONT>
<FONT COLOR="#000000">I'm mildly surprised that there's not been more discussion of it here,</FONT>
<FONT COLOR="#000000">as it does cross OS lines pretty thoroughly.</FONT>
<FONT COLOR="#000000">The current circumvention appears to be to ensure that DNS query source</FONT>
<FONT COLOR="#000000">ports are properly randomized, while the purported fix is to implement</FONT>
<FONT COLOR="#000000">DNSSEC.</FONT>
<FONT COLOR="#000000">For my name servers, I configure them so that they only honor recursive</FONT>
<FONT COLOR="#000000">queries from within my network; I gather, though, that this does not</FONT>
<FONT COLOR="#000000">avoid the issue, as it would still be possible to place a reference</FONT>
<FONT COLOR="#000000">(e.g., a URL) to a particular DNS zone to cause my name server to</FONT>
<FONT COLOR="#000000">perform a query that is at least strongly influenced by an untrusted</FONT>
<FONT COLOR="#000000">party outside my network.</FONT>
<FONT COLOR="#000000">Comments? Or is this all old hat?</FONT>
<FONT COLOR="#000000">Peace,</FONT>
<FONT COLOR="#000000">david</FONT>
</PRE>
</BLOCKQUOTE>
<BR>
>From what I have been reading, the issue is that the nounce (query ID) is just 16 bits.<BR>
<BR>
There seems to be two issues.<BR>
<BR>
The first is that the random number generators (used to create the nounce) tend to not<BR>
be random enough.<BR>
<BR>
The second is that 16 bit nounce is not enough space.<BR>
<BR>
So there are a couple fixes:<BR>
<BR>
Best fix is a protocol update to move the nounce from 16 bits to 128 bits. Not immediately<BR>
feasible due to cross implementation issues/backwards compatibility.<BR>
<BR>
Use DNSSEC. Not really feasible because of compute resources for zone signing/signature<BR>
authentication/trust infrastructure build-out.<BR>
<BR>
Work around:<BR>
<BR>
Fix the random number generator.<BR>
<BR>
Artificially extend the nounce by making the source port part of it. What you will see is that<BR>
every outbound query will have a different random source port. So, if you have 200 concurrent<BR>
recursive queries out in the wild, you will have 200 random open UDP ports. (One per query.)<BR>
<BR>
This extension of the nounce is the main part of the patches going out. Almost all of the<BR>
implementations pick a random port (which can be locked down to a specific port in the config)<BR>
at start and stick with it for all queries.<BR>
<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
<PRE>
--
END OF LINE
--MCP
</PRE>
</TD>
</TR>
</TABLE>
</BODY>
</HTML>