DNS Spoofing

MadHag

MadHag

Verified User
Joined
Aug 26, 2008
Messages
64
Location
French Pyrenees
Is this a Debian or an DA issue?

Synopsis :

The remote name resolver (or the server it uses upstream) may be vulnerable
to DNS cache poisoning.


Description :

The remote DNS resolver does not use random ports when making queries to
third party DNS servers.

This problem might be exploited by an attacker to poison the remote DNS
server more easily, and therefore divert legitimate traffic to arbitrary
sites.

See also :

http://www.kb.cert.org/vuls/id/800113

Solution :

Contact your DNS server vendor for a patch

Risk factor :

High / CVSS Base Score : 9.4
(CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C)

Plugin output :

The ports used by **.**.**.** are not random.
An attacker may spoof DNS responses.
List of used ports :
- 53
- 53
- 53
- 53

CVE : CVE-2008-1447
BID : 30131
Click to expand...

David
 
It is a DNS issue not specific to any operating system and certainly not a control panel.

DNS cache poisoning
Click to expand...

If you do not use this dns server as a caching dns server then you don't have a problem anyway. Its mostly a problem for isp's not hosts.
 
When you are browsing the web each site you go to has to be resolved to an ip address. This is usually done by your isp. If your isp is running a vulnerable server then its cache could become poisoned and redirect you to another server that has been made to look like the one you really want to go to.

and therefore divert legitimate traffic to arbitrary
sites.
Click to expand...
Maybe you want to login to your paypal account and so you go to paypal.com but because your isp's dns cache has been poisoned you are not really going to paypal you are going to a paypal phishing site.

Most hosts are only serving dns for sites they hosts and so are not affected by this problem.
 
You can take a look at :
http://www.cert.org/archive/pdf/dns.pdf

You can add to your named.conf (options area):

allow-transfer { none; }; (if your name servers reside in one server, or change none to your trusted other ns ips)

And to avoid DNS cache poisoning add

allow-recursion { localnets; localhost;}; (or add the others ns if not in the same network)

Be sure also to have the latest version of bind.
 
MadHag said:
Ok, thanks, it's just that that was a result from a scan on MY server.
Click to expand...
You really shouldn't be using your authoritative DNS server for resolution of outside domains. You should turn recursion off; see the immediately preceeding post.

However if you do that make sure you've got at least two valid recursive servers listed in your /etc/resolv.conf file.

Jeff
 
Thanks for that, I entered both lines into named.conf and I no longer get the high alert warning in Nessus.

Just a clamav warning to sort out now and I will be happy.

David
 
Named stopped.

Actually, not quite out of the woods. Named is showing as stopped in DA system monitor and it will not start. Yet all my sites are still up.

Any ideas what is going on?

David
 
MadHag said:
Actually, not quite out of the woods. Named is showing as stopped in DA system monitor and it will not start. Yet all my sites are still up.
Click to expand...
They can't help you without any logs. Please give us some logs of named why its crashed.
 
What do you mean by they, daveyw? :) Personally I neither want, nor even read, huge log snippets.

MadHag, you've probably made an error in one or both of those lines.

Your /var/log/messages file will contain any errors that named is encountering which will shut it down on startup. You can simply tail the log while restarting BIND.

If you don't understand the errors post them. But not the entire logs unless daveyw intends to help you with them.

Jeff
 
You must log in or register to reply here.
Back
Top