DNS patches cause problems, developers admit
ISC to repatch BIND over performance issues; Microsoft spells out multiple Windows bugs in its July 8 update
Computerworld - Patches released earlier this month to quash a critical bug in the Domain Name System (DNS) have slowed servers running BIND, the Internet's most popular DNS software, and crippled some systems using Windows Server.
Paul Vixie, who heads the Internet Systems Consortium (ISC), the group responsible for the BIND (Berkeley Internet Name Domain) software, acknowledged that there were problems with the July 8 fix that was rolled out as part of a multivendor update meant to patch a cache poisoning flaw discovered months before by researcher Dan Kaminsky.
"During the development cycle, we became aware of a potential performance issue on high-traffic recursive servers, defined as those seeing a query volume of greater than 10,000/queries per second," said Vixie in a message posted Monday afternoon to a BIND mailing list. "Given the limited time frame and associated risks, we chose to finish the patches ASAP and accelerate our work on the next point releases that would address the high-volume server performance concerns.
"Our immediate goal was to make patches publicly available as soon as possible," Vixie explained.
Vixie wasn't specific about the extent of the performance problems facing high-volume DNS servers, but he said that a second round of patches, due later this week, will remedy port allocation issues and "allow TCP queries and zone transfers while issuing as many outstanding UDP queries as possible."
However, Vixie stressed that administrators shouldn't roll back the July 8 patched editions even if their servers are running slowly. "Until the release of the -P2 code, it is imperative that you run a -P1 version of BIND on your caching resolvers," he said. "The vulnerability is of more concern than a slow server."
The flaw Kaminsky uncovered in February makes it much easier than originally thought to insert bogus information into the Internet's routing infrastructure. A successful attack would let criminals silently redirect requests for a legitimate site to a bogus one set up to skim personal information, such as passwords to online banking accounts, from duped users.
Earlier this month, when Kaminsky announced that the vulnerability had been patched by several vendors, including ISC, Microsoft Corp. and Cisco Systems Inc., he applauded their quick cooperation. "I want to get a lot of credit to the vendors here," he added in an interview last week. "The vendors were everything that the security community ever could have asked for," he said, referring to the resources they allocated to the problem and the speed with which they cranked out patches.
Patching the DNS flaw became more important last week after hackers took exploit code public.
ISC wasn't the only vendor involved in first-round DNS patching that has issued a mea culpa. Two weeks ago, Microsoft confirmed that its July 8 DNS update, tagged as MS08-037, was crippling machines running Windows Small Business Server, a suite based on, among other programs, Windows Server 2003.
"Some customers have reported seeing random problems with services after installing MS08-037," reported several Microsoft engineers in a post to the Small Business Server (SBS) blog on July 17.
One SBS component that might fail to start, said Microsoft, was the IPSEC service, which would knock the server off the network.
Last Friday, the company unveiled a pair of support documents that spelled out the patch's unintended side effects, but also added Exchange Server 2003 and Internet Security and Acceleration (ISA) Server to the affected list.
A second issue involves every supported version of Windows, ranging from Windows 2000, XP and Vista to Server 2003 and Server 2008. "You may experience issues with UDP-dependent network services after you install the Domain Name System (DNS) Server service security update 953230 (MS08-037) and then restart the computer," Microsoft said.
In both instances, Microsoft offered work-arounds in the support documents but did not say whether, or when, the original DNS patch would be re-released. In response to questions, a company spokesman today said, "Microsoft currently has no plans to reissue MS08-037.
Robert McMillan of the IDG News Service contributed to this story.
Read more about Networking in Computerworld's Networking Topic Center.
- Need to Replace MS Threat Management Gateway? Read this article to learn how F5's Secure Web Gateway solution provides a full set of features that can help you successfully migrate...
- The Shortfall of Network Load Balancing Applications running across networks encounter a wide range of performance, security, and availability challenges as IT department strive to deliver fast, secure access...
- Leave No App Behind with Software Defined Application Services F5 Software Defined Application Services (SDAS) is the next-generation model for delivering application services that enables service injection, consumption, automation, and orchestration across...
- Five Key Issues for DNS - The Next Network Management Challenge Since every icon and URL and all embedded content on a website requires a DNS lookup, loading complex sites necessitates hundreds of DNS...
- Live Webcast IBM FlashSystem V840: Leveraging Software-Defined Flash to Drive Your Business With end-to-end, tightly integrated functionality and super-fast flash technology, products like IBM FlashSystem V840 Enterprise Performance Solution empower businesses to leverage the efficiency...
- DevOps with PureApplication System: Reduce cost and speed delivery with an integrated IBM Cloud solution Join this webcast to hear what ING Netherlands has been able to achieve while deploying DevOps tools from IBM Rational. An ING executive...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different.... All Networking White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!