Microsoft Downplaying Recent DNS Vulnerability

Microsoft Watch writes "Microsoft downplays a recent DNS vulnerability in all Microsoft operating systems (XP, Vista, 2000, and 2003), claims Amit Klein, the security researcher who published the original vulnerability description (PDF) earlier this month. According to Klein, the description in Microsoft's Secure Windows Initiative blog entry is misleading, contains disinformation about the DNS transaction ID algorithm, and downplays the severity of the issue. Klein refutes Microsoft's claim that there is no way to reproduce the next transaction ID, given a series of observed transaction IDs. He shows that this is possible in his paper, which Microsoft had before publishing the SWI post, as well as on the series of data provided in the SWI blog itself."

Comments

Gates mocrosoft mind trick..

[s0litaire]

Gates *waves his hand*:"This is not a flaw.." MS Drone user: "This is not a flaw" Gates: *ignore this* MS Drone user "I'll ignore this..." Evil cyber hacker : "WTF!! Another hole! I can't keep up!"

Re:RTFA

[RiotingPacifist]

shh, dont bring facts into a perfectly good microsoft bashing, the mods round here dont like that.

Re:Unlikely, but...

[Divebus]

Is it possible that Microsoft was downplaying it to lessen the effects? Microsoft will certainly take security to the next level:
  "Are you sure you want to poison the DNS stub resolver cache? Allow or Deny."
That'll fix it.