Security Alert: DNS Security Vulnerability

Earlier this week Dan Kaminsky announced a major security vulnerability in the 25 year old DNS protocol. DNS is used to translate human readable addresses such as www.google.com into IP addresses that computers use to talk to one another across networks such as the Internet. Kaminsky, a security researcher with IO Active, stressed that the issue was in the design of DNS and therefore affected software across all operating systems.

Of course, the most popular DNS software on Linux is BIND, which is shipped with almost every distribution. Kaminsky worked with many major software vendors to ensure that security updates were available simultaneously. Debian, Red Hat, Ubuntu, and many other distributions have already provided updated versions of BIND. One thing to note is that if you are running BIND 8 servers anywhere you should take this opportunity to upgrade to BIND 9. The BIND 8 codebase is no longer supported, and security updates are not available.

Even though this is a protocol issue, some software and services are not affected. Systems using Dan Bernstein's djbdns package are not vulnerable to this type of attack. Users of PowerDNS and OpenDNS are also not susceptible. Kaminsky has provided a tool on his website that you can use to check your DNS service.

Although this is a major security issue, the details of the exploit have not yet been released by Kaminsky. The coordinated effort with vendors gave them a chance to patch their systems before Kaminsky takes the stage at the annual Black Hat security conference next month in Las Vegas. It is expected that he will discuss the vulnerability in depth at the conference, at which point exploits are sure to begin appearing. An Executive Overview (PDF) of the vulnerability is available, along with the CERT Advisory. A list of the affected systems is given near the bottom of the advisory.

If you manage DNS services please take time to update your system with the latest software available.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

It seems that djbdns has

Anonymous's picture

It seems that djbdns has other problems:

http://secunia.com/advisories/33855/

Another (non affected) Service

FredR's picture

I currently run Bind 9 as my hidden master, and the world points to EveryDNS which I believe runs djbdns. It's no surprise, because it's a free service offered by a fellow named David Ulevitch, one of the guys on the OpenDNS team.

Although my Bind 9 on Slackware 9.1 was vulnerable, (it's now patched), I was relieved to see this EveryDNS uses unaffected software as the whole internet points to it for my domains.

I love the service, it's been great, and geographically diverse, too! I've been using it for years and even donated a little. Give it a try!

-- FLR or flrichar is a superfan of Linux Journal, and goofs around in the LJ IRC Channel

Only resolving DNS is affected

Cory Wright's picture

This exploit only affects DNS resolvers. EveryDNS is an authoritative DNS service (using tinydns and axfrdns from djbdns), and therefore isn't vulnerable. BIND is both a resolving DNS server and an authoritative DNS server in the same package. Where OpenDNS could have been vulnerable (it isn't), EveryDNS doesn't qualified for this exploit.

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState