The exploit is still out there. Apple Still has not patched the DNS vunerability. This vunerability here has been running for weeks in the security circles. It feels like the energizer bunny of vunerabilities. People just get the damn patch done will you! Enough already. Ok- my rant is done.
On Slashdot Steve Shockley notes an article up at TidBITS on Apple’s unexplained failure to patch the DNS vulnerability that we have been discussing for a few weeks now. “Apple uses the popular Internet Systems Consortium BIND DNS server, which was one of the first tools patched, but Apple has yet to include the fixed version in Mac OS X Server, despite being notified of vulnerability details early in the process and being informed of the coordinated patch release date.”
More good stuff on Slashdot below:
Related posts from Slashdot
Kaminsky’s DNS Attack Disclosed, Then Pulled
Reverse engineering expert Halver Flake has recently mused on Dan Kaminsky’s DNS vulnerability. Apparently his musings were close enough to the mark to cause one of the Matasano team, who apparently already knew of the attack, to publish the details on the Matasano blog in a post entitled ‘Reliable DNS Forgery in 2008.’ The blog post has since been pulled, but evidence of it exists on Google and elsewhere. It appears only a matter of time now before the full details leak.” Reader Time out contributes a link to
coverage on ZDNet as well.
That didn’t take long. ZDNet is reporting that HD Moore has released exploit code for Dan Kaminsky’s DNS cache poisioning vulnerability into the point-and-click Metasploit attack tool. From the article: ‘This exploit caches a single malicious host entry into the target nameserver. By causing the target nameserver to query for random hostnames at the target domain, the attacker can spoof a response to the target server including an answer for the query, an authority server record, and an additional record for that server, causing target nameserver to insert the additional record into the cache.’ Here’s our previous Slashdot coverage.”
“Austrian CERT used data from one of their authoritative DNS server to measure the rate at which the latest DNS patch (source port randomization) is being rolled out to larger recursive name servers. While about half the traffic (PDF) they receive is now using source port randomization, their data suggest that this is due to ISPs who roll out such fixes immediately. The rate of patching has fallen to disappointingly low levels since. If your ISP isn’t patched, perhaps it is time to switch.” After details of the DNS vulnerability
leaked, researchers |)ruid and HD Moore
released attack code; ZDNet’s security blog has
an analysis.