Massive, Coordinated Patch To the DNS Released

tkrabec alerts us to a CERT advisory announcing a massive, multi-vendor DNS patch released today. Early this year, researcher Dan Kaminsky discovered a basic flaw in the DNS that could allow attackers easily to compromise any name server; it also affects clients. Kaminsky has been working in secret with a large group of vendors on a coordinated patch. Eighty-one vendors are listed in the CERT advisory (DOC). Here is the executive overview (PDF) to the CERT advisory — text reproduced at the link above. There's a podcast interview with Dan Kaminsky too. His site has a DNS checker tool on the top page. "The issue is extremely serious, and all name servers should be patched as soon as possible. Updates are also being released for a variety of other platforms since this is a problem with the DNS protocol itself, not a specific implementation. The good news is this is a really strange situation where the fix does not [immediately] reveal the vulnerability and reverse engineering isn't directly possible."

Comments

Re:So give a layman explanation

[X0563511]

Dan Kaminsky discovered a basic flaw in the DNS that could allow attackers easily to compromise any name server; it also affects clients.

If you don't understand that, you don't need to care.

More independent verification needed

[suso]

Here everyone, install this patch to your Unix/Linux DNS servers that was conceived of on the Microsoft campus.

While if true, one should be expedient to fix it, one should also be careful to verify that this is true.

Re:More independent verification needed

[suso]

Well of course it is. Anyone can make a list. From the investigating I'm doing right now, it does seem to be legit. But I just think its important to be careful. Don't just blindly patch what is probably the most critical service on your network.

Re:More independent verification needed

[isorox]

but if it's something you consider that critical and are that suspicious of, yes, your staff should have the relevant expertise in-house to read and evaluate what's going on.

Or have the ability to recognise they are out of their depth and be able to use resources from other departments (or even external suppliers)

Re:More independent verification needed

[Penguin Follower]

So you are insinuating that all system admins also have to be programmers? There are plenty of people with the skills to set up, maintain, and secure (properly) systems of all kinds (*nix, Windows, Macs, Cisco equip) who are NOT programmers. Some people are not cut out to be programmers, but are quite capable outside of that realm...

Re:More independent verification needed

[Schraegstrichpunkt]

Right... How many otherwise competent sysadmins do you know who can't C code? I've known plenty. Usually the good coders get jobs as coders, rather than as sysadmins.

Re:More independent verification needed

[lukas84]

Why the sarcasm? If you're hiring sysadmins who aren't also system-level developers, you're not hiring people who can Do The Job Right.

People with that amount of expertise will hardly be challenged by sysadmin position. And without a challenge you'll get bored. As such, you'll never find people with such high qualifications in sysadmin position.

A sysadmin of course needs to know his stuff, and especially a unix sysadmin should be able to read C code and get the basics (and have extensive knowledge in scripting languages).

But i doubt that understand the gritty details how bind works (or reading a DNS packet with just a hex editor) is something that can be expected from a sysadmin.

But i also might just be defending my lack of knowledge, so beware :)

Re:Hmmm

[outZider]

Because it isn't 1912, and we aren't on the Titanic. They can say with reasonable confidence that it's difficult to find the underlying issue, but nothing is hackproof, or sinkproof, or lameproof.

Re:My first response is to call Bullshit

[winkydink]

Google Dan Kaminsky and come back and talk.

Re:Oh cool!

[GeffDE]

Seriously, is an IP address too much to ask?

Article should be modded +1 Ironic because the links necessitate the use of DNS...at the very least, the DNS checker should have been a straight IP.

WTF?

Re:The real solution...

[Ethanol]

The largest DLV repository that validates that the DNSKEYs belong to who they say they belong to (think Verisign-style verification), is run by isc.org.

(My employer, BTW.)

I'm a part of a DNSSEC monitoring project (called SecSpider). [...] This serves the same purpose as ISC's repo, but the data is collected in an orthogonal manner. We currently have DLV records for over 12000 zones, although we haven't directly verified the identity of any of them.

That's an intriguing idea, but it doesn't really serve the same purpose as ISC's DLV until you do verify identity. (Would UCLA's lawyers be comfortable with someone relying on your DLV record repository for, say, banking transactions?)

Re:So give a layman explanation

[deathsyn]

Dan Kaminsky discovered a basic flaw in the DNS that could allow attackers easily to compromise any name server; it also affects clients.

If you don't understand that, you don't need to care.

What's funny is that the CERT advisory gives Dan Bernstein credit for the work around, which he came up with over 7 years ago.