Security Intelligence Operations

DNS implementations of multiple vendors contain a vulnerability that could allow an unauthenticated, remote attacker to conduct DNS cache poisoning attacks.

The vulnerability is due to the use of insufficient entropy when creating DNS transaction identifiers. An unauthenticated, remote attacker could exploit the vulnerability by sending a number of spoofed DNS replies to an affected system. A successful exploit could allow the attacker to poison the local DNS cache of the system. This cache poisoning could allow the attacker to conduct further attacks against hosts that rely on the affected system to perform DNS queries or against the affected system itself.

Exploit code that allows the insertion of malicious DNS records to poison the cache of the targeted DNS server and complete domain hijacking through the modification of start of authority (SOA) records is available.

Multiple vendors have confirmed the vulnerability and released updated software.

Multiple vendor products that support DNS services are affected. Individual vendor advisories detail specific affected products.

To exploit the vulnerability, an attacker must monitor DNS requests to the affected system.  There are several methods by which an attacker can monitor these requests.  However, the most likely vector may take the form of a website that is specifically designed for monitoring.  If an attacker can convince a user to visit an attacker-controlled site, the attacker could force the user's machine to make numerous requests to an attacker-controlled DNS server.  An affected DNS server sends the TXID of the transaction in the initial DNS Query message.  This behavior allows the attacker to determine the current value of the entropy pool that the server is using.  By forcing the server to send a number of requests, the attacker may gain enough information to extrapolate the range of TXIDs that may be used in the immediate future.  The attacker could then use the predicted values to construct seemingly valid malicious responses that may be accepted and processed by the DNS server, entering spoofed DNS entries and poisoning the local DNS cache.

After the attacker causes spoofed DNS entries, the attacker could then cause client requests to be redirected to a malicious site.  If the attacker can replace popular DNS names, the attacker could redirect clients to malicious websites or other services, possibly in an attempt to install malicious software or conduct other attacks against affected systems.

Note that this is not a new issue to DNS servers.  The ability to spoof DNS transaction IDs has been known and guarded against in many ways over the years.  However, it would appear that recently released independent research has identified a reliable and effective method of predicting transaction IDs and source port numbers, forcing vendors to fundamentally rethink the method that is used to generate such identifiers.

Event data from Cisco Remote Management Services indicates a significant increase in activity on signature 4004/0.  The data was captured on August 12, 2008.  This activity can be triggered by normal network traffic.  The signature is also known to be triggered by DNS requests for MX records.  These requests may not be malicious, but they could be related to spam.  This increase in traffic was expected after technical details were released in a presentation at the Black Hat security conference on August 6, 2008.

Technical details were withheld by vendors and the vulnerability researcher to allow for timely response to correct this vulnerability.  However, significant but incomplete details regarding the vulnerability were posted publicly by other parties.  This led to the release of functional exploit code prior to the Black Hat presentation where the information was expected to be provided. 

Functional exploit code that allows the insertion of malicious DNS records to poison the cache of the targeted DNS server has been publicly released.  This exploit caches a single malicious host entry into the DNS server.  A successful exploit in this manner allows the attacker to spoof DNS entries, causing the target DNS server to insert the additional malicious record into the cache.  Additional exploit code that allows for complete domain hijacking through the modification of SOA records is also available.  Multiple exploit tools are publicly available, increasing the risks associated with not patching affected products.

Cisco has re-released a security advisory to address Cisco bug IDs CSCso81854, CSCsq01298, and CSCsq21930 at the following link: cisco-sa-20080708-dns

ISC has released a security advisory at the following link: CERT VU#800113 DNS Cache Poisoning Issue

Microsoft has released a security advisory at the following link: 956187

Microsoft has re-released a security bulletin at the following link: MS08-037

Ruby has released a security advisory available at the following link: Multiple vulnerabilities in Ruby 

Alcatel-Lucent has released a security advisory at the following link: Multiple DNS implementations vulnerable to cache poisoning

Apple has released security updates at the following links: Apple Security Update 2008-005 and Security Update 2008-006

Astaro has released a security bugfix report at the following link: Up2Date 7.202 released

Avaya has released a security advisory at the following link: ASA-2008-288

Blue Coat Systems has released a security advisory at the following link: DNS Cache Poisoning Vulnerability (CERT VU#800113) 

Citrix has re-released a security advisory at the following link: CTX117991

Debian has released security advisories at the following links:

DSA-1603-1
DSA-1604-1
DSA-1605-1
DSA-1617-1 

F5 has released a security advisory for registered users at the following link: sol8938

FreeBSD has released a security advisory at the following direct-download link: FreeBSD-SA-08:06 

Gentoo has released security advisories at the following links: GLSA 200807-08 and GLSA 200812-17

HP has released security bulletins at the following links: HPSBUX02351, HPSBOV02357, HPSBTU02358, HPSBMP02404, and HPSBNS02405 

IBM has released a security advisory at the following link: 4526

Ingate has provided release notes at the following link: Release notice for Ingate Firewall 4.6.4 and Ingate SIParator 4.6.4

Juniper has released a security advisory for registered users at the following link: PSN-2008-06-040 

Mandriva has released a security advisory at the following link: MDVSA-2008:139 

Nominum has released a security advisory at the following link: NOM-20080708 

Novell has released a security announcement and a technical document at the following links: SUSE-SA:2008:033 and 7000912 

OpenBSD has released security announcements at the following links: 013: SECURITY FIX: July 23, 2008 and 004: SECURITY FIX: July 23, 2008

Red Hat has re-released a security advisory at the following link: RHSA-2008:0533

Secure Computing has released a statement at the following link: Secure Computing

Slackware has released security advisories at the following links: SSA:2008-191-02, SSA:2008-205-01, and SSA:2008-334-01 

Sun has re-released an alert notification at the following link: 240048 

Turbolinux has released a security advisory at the following link: TLSA-2008-26

Ubuntu has released a security notice at the following link: USN-622-1

VMware has re-released a security advisory at the following link: VMSA-2008-0014.3

US-CERT has released a vulnerability note at the following link: VU#800113