From: InfoSec News (alertsinfosecnews.org)
Date: Thu Sep 06 2007 - 00:08:05 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.techworld.com/security/news/index.cfm?newsID=9998

By Jeremy Kirk
IDG news service
05 September 2007

A security researcher has found a serious vulnerability in Bind 8
forcing the software's maintainers to issue an advisory for users to
upgrade to Bind 9.4, the latest version.

The flaw within Bind 8 software could misdirect users to a fraudulent
wedsite even if a user typed in the correct URL wrote Amit Klein, chief
technology officer for security vendor Trusteer. Klein discovered the
problem.

Users are being advised to upgrade to Bind 9.4, the latest version of
the software, which underwent an architecture rewrite to improve
security. The software, looked after by the Internet Software Consortium
(ISC), is free to download.

ISC issued an interim patch, but due to other weaknesses in the
software, ISC is also ending support for Bind 8.

"It's never easy to retire a product," wrote wrote ISC in an advisory.
"The security issues of Bind 8 are many, and seven years after the
release of Bind 9, ISC must devote our efforts to maintaining and
enhancing the current version."

About 14 percent of the DNS servers on the Internet in 2006 were still
using Bind 8, according to Infoblox Inc., which conducts an annual
survey of DNS servers.

"Bind 8 is still a very popular DNS server nowadays, thus this attack
applies to a big part of Internet users," Klein wrote.

In a research paper, Klein described a weakness in the algorithm Bind 8
uses to generate transaction IDs, apparently random serial numbers that
allow it to spot whether someone is trying to supply it with false
information in respose to queries. The weakness makes it possible to
observe a few queries and then predict the transaction ID in the
sequence, Klein wrote.

Using that information, an attacker can then send erroneous information
to the DNS server, "poisoning" the address stored against a particular
domain name in its memory cache. Thus, traffic intended for a certain
Web site from users of that DNS server can be diverted to another server
containing a fraudulent site, a deception known as "pharming."

Although Bind 9 has a better transaction ID algorithm, it could also be
vulnerable, Klein wrote.

____________________________________
Attend HITBSecConf2007 - Malaysia
Taking place September 3-6 2007 featuring seven tracks of technical
training and a dual-track security conference with keynote speakers
Lance Spitzner and Mikko Hypponen! - Book your seats today!
http://conference.hitb.org/hitbsecconf2007kl/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]