Users urged to patch serious hole in BIND 9 DNS server
BIND 9 is among the most widely used software packages used on DNS servers
IDG News Service - A security researcher has reported a serious vulnerability in BIND 9, the software widely used in the Internet's DNS addressing system.
Users of the software, which include Internet providers and large companies, are being advised to patch the software immediately to prevent end users from being vulnerable to pharming attacks, when they are directed to a Web site set up by criminals.
BIND 9, or Berkeley Internet Name Domain 9, is among the most widely used software packages used on DNS servers. When a user types a Web address into a browser, the request goes to a DNS server, which finds the corresponding numerical IP address and locates the Web site.
For security purposes, when a browser queries a DNS server, a random 16-bit transaction ID is used to verify the response from the server. However, according to Amit Klein, chief technology officer at security vendor Trusteer Ltd., the transaction ID is not random at all. "On the contrary, this transaction ID is very predictable," he wrote in a paper describing the problem this week.
The vulnerability in BIND 9 could allow an attacker to force the DNS server to return an incorrect Web site to a user, a trick known as DNS cache poisoning, or pharming. The problem exists in all BIND 9 releases when the software is being used in a caching server configuration, Klein wrote.
Other security watchers confirmed the problem. "This is very much a feasible attack," wrote Johannes Ullrich, chief technical officer at the SANS Internet Storm Center. "Best to patch your BIND server soon."
Klein released his paper on Monday, the same day that Internet Systems Consortium issued a patch for the problem. ISC is a nonprofit company and the caretaker of BIND 9, which is used on some 80% of the DNS servers on the Internet. Trusteer said it notified ISC of the problem on May 29.
ISC advised users to install an upgrade for BIND 9 from its Web site.
The problem is particularly worrisome since desktop security software is not effective at preventing this style of attack, Klein wrote. The attack does not directly involve a user's computer or the DNS server, but rather data that is cached on the server.
Most DNS servers cache queries, or store them in memory, to improve performance. But if an attacker requests a Web address that is not stored in the server's cache, a hacker could flood the cache with false information -- such as the address of a different Web site -- which would then be returned for future DNS queries, Klein wrote.
That means a user could be directed to a fraudulent Web site, even though the user typed the correct address in their browser. The site could then try to exploit other security weaknesses in a user's PC, or trick them into providing sensitive information.
Because the transaction ID is not random and can be figured out, an attacker could execute the attack with as few as a single attempts, Klein wrote. "This is a powerful attack, as it retracts the security of BIND 9 to almost where it was over a decade ago," he said.
- Top 12 Laptop Bags for Mobile Pros
- Think Deleted Text Messages Are Gone Forever? Think Again
- 7 New Faces of the C-suite
- 5 Ways CIOs Can Rationalize Application Portfolios
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Alert Logic for PCI DSS Compliance To achieve PCI DSS compliance, you must identify and remediate all critical vulnerabilities detected during PCI scans. Threat Manager streamlines this process by...
- Cybersecurity Imperatives Reinvent Your Network Security With Palo Alto Networks The Rise of CyberSecurity
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts