copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
Search this site

On this site

 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login


AL-2008.0080 -- [Win][UNIX/Linux][Juniper][Cisco] -- Multiple DNS implementations vulnerable to cache poisoning

Date: 09 July 2008
References: ESB-2008.0754  ESB-2008.0804  ESB-2008.0671  ESB-2008.0672  ESB-2008.0673  ESB-2008.0674  ESB-2008.0680  ESB-2008.0684  ESB-2008.0693  AA-2008.0157  
ESB-2008.0715  AA-2008.0161  AL-2008.0082  AL-2008.0083  ESB-2008.0738  ESB-2008.0739  ESB-2008.0741  ESB-2008.0754  ESB-2008.0769  AU-2008.0017  ESB-2008.0787  
ESB-2008.0789  ESB-2008.0804  ESB-2008.0857  AA-2008.0189  AA-2008.0192  AA-2008.0194  ESB-2009.0105  ESB-2009.0116  AA-2009.0101  ESB-2014.2419.2  

Click here for printable version
Click here for PGP verifiable version
Hash: SHA1

A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2008.0080 -- AUSCERT ALERT
        Multiple DNS implementations vulnerable to cache poisoning
                                9 July 2008


        AusCERT Alert Summary

Product:              Microsoft Windows 2000 Server DNS
                      Microsoft Windows Server 2003 DNS
                      Microsoft Windows Server 2008 DNS
                      BIND 9.3 prior to 9.3.5-P1
                      BIND 9.4 prior to 9.4.2-P1
                      BIND 9.5 prior to 9.5.0-P1
                      Cisco IOS Software
                      Cisco Network Registrar
                      Cisco Application and Content Networking System
                      Cisco Global Site Selector Used in Combination with
                          Cisco Network Registrar
                      Juniper Firewalls with ScreenOS
                      Juniper J-Series Routers with JUNOS built prior to 
                          May 23, 2008
                      Juniper switching products with JUNOS buitl prior to
                          May 23, 2008
                      Solaris 8 BIND 8.2.4 and prior
                      Solaris 9 BIND 8.3.3 and prior
                      Solaris 10 BIND 9.3.4-P1 and prior
                      Nominum versions prior to
                      Vantio versions prior to
Publisher:            US-CERT
Operating System:     UNIX variants (UNIX, Linux, OSX)
Impact:               Provide Misleading Information
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-1447

Original Bulletin:

Comment: Products not mentioned should check with their vendors if they are
         Regarding the ISC BIND implementations, older versions of BIND 8 and
         BIND 9 will not be patched as they are EOL.

Revision History:     July 9 2008: Added specific revision numbers for BIND
                      July  9 2008: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

Hash: SHA1

                National Cyber Alert System

           Technical Cyber Security Alert TA08-190B

Multiple DNS implementations vulnerable to cache poisoning

   Original release date: July 08, 2008
   Last revised: --
   Source: US-CERT

Systems Affected

   Systems implementing:
     * Caching DNS resolvers
     * DNS stub resolvers

   Affected systems include both client and server systems, and any other
   networked systems that include this functionality.


   Deficiencies in the DNS protocol and common DNS implementations facilitate
   DNS cache poisoning attacks. Effective attack techniques against these
   vulnerabilities have been demonstrated.

I. Description

   DNS cache poisoning (sometimes referred to as cache pollution) is an attack
   technique that allows an attacker to introduce forged DNS information into
   the cache of a caching nameserver. The general concept has been known for
   some time, and a number of inherent deficiencies in the DNS protocol and
   defects in common DNS implementations that facilitate DNS cache poisoning
   have previously been identified and described in public literature. Examples
   of these vulnerabilities can be found in Vulnerability Note VU#800113.

   Recent research into these and other related vulnerabilities has produced
   extremely effective exploitation methods to achieve cache poisoning. Tools
   and techniques have been developed that can reliably poison a domain of the
   attacker's  choosing on most current implementations. As a result, the
   consensus  of  DNS  software  implementers is to implement source port
   randomization in their resolvers as a mitigation.

   US-CERT  is  tracking  this  issue as VU#800113. This reference number
   corresponds to CVE-2008-1447.

II. Impact

   An attacker with the ability to conduct a successful cache poisoning attack
   can cause a nameserver's clients to contact the incorrect, and possibly
   malicious, hosts for particular services. Consequently, web traffic, email,
   and other important network data can be redirected to systems under the
   attacker's control.

III. Solution

Apply a patch from your vendor

   Patches have been released by a number of vendors to implement source port
   randomization in the nameserver. This change significantly reduces the
   practicality of cache poisoning attacks. Please see the Systems Affected
   section of Vulnerability Note VU#800113 for additional details for specific

   As mentioned above, stub resolvers are also vulnerable to these attacks.
   Stub resolvers that will issue queries in response to attacker behavior, and
   may  receive  packets  from  an  attacker,  should  be patched. System
   administrators should be alert for patches to client operating systems that
   implement port randomization in the stub resolver.


   Restrict access
   Administrators, particularly those who are unable to apply a patch, can
   limit exposure to this vulnerability by restricting sources that can ask for
   recursion. Note that restricting access will still allow attackers with
   access to authorized hosts to exploit this vulnerability.

   Filter traffic at network perimeters
   Because the ability to spoof IP addresses is necessary to conduct these
   attacks, administrators should take care to filter spoofed addresses at the
   network perimeter. IETF Request for Comments (RFC) documents RFC 2827, RFC
   3704, and RFC 3013 describe best current practices (BCPs) for implementing
   this defense. It is important to understand your network's configuration and
   service requirements before deciding what changes are appropriate.

   Run a local DNS cache
   In lieu of strong port randomization characteristics in a stub resolver,
   administrators can protect their systems by using local caching full-service
   resolvers, both on the client systems and on servers that are topologically
   close  on  the  network  to the client systems. This should be done in
   conjunction with the network segmentation and filtering strategies mentioned

   Disable recursion
   Disable recursion on any nameserver responding to DNS requests made by
   untrusted systems.

   Implement source port randomization
   Vendors that implement DNS software are encouraged to review IETF Internet
   Draft, "Measures for making DNS more resilient against forged answers," for
   additional information about implementing mitigations in their products.
   This document is a work in progress and may change prior to its publication
   as an RFC, if it is approved.

IV. References

     * US-CERT Vulnerability Note VU#800113 -
     * US-CERT Vulnerability Note VU#484649 -
     * US-CERT Vulnerability Note VU#252735 -
     * US-CERT Vulnerability Note VU#927905 -
     * US-CERT Vulnerability Note VU#457875 -
     * Internet Draft: Measures for making DNS more resilient against forged
       answers -
     * RFC 3833 - <>
     * RFC 2827 - <>
     * RFC 3704 - <>
     * RFC 3013 - <>
     * Microsoft Security Bulletin MS08-037 -
     * Internet     Systems    Consortium    BIND    Vulnerabilities    -


   US-CERT thanks Dan Kaminsky of IOActive and Paul Vixie of Internet Systems
   Consortium (ISC) for notifying us about this problem and for helping us to
   construct this advisory.

   The most recent version of this document can be found at:


   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <> with "TA08-190B Feedback VU#800113" in the

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <>.

   Produced 2008 by US-CERT, a government organization.

   Terms of use:


   Revision History

   July 8, 2008: Initial release

Version: GnuPG v1.4.5 (GNU/Linux)


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email:
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.