Re: [nznog] DNS Vulnerability

From reading the press on this one, you'd think the sky was falling and Dan Kaminsky was the greatest hero ever for discovering this ... but see RFC 3833 (DNS Threat Analysis), published in 2004, and various prior works that go into the specific problem in more detail. It's not exactly news to those who pay attention to DNS issues.

Of course it's nice that BIND finally has source port randomisation, after pointedly ignoring the issue for quite a while. -- don Jamie Baddeley wrote:

Vulnerability Summary: Deficiencies in the DNS protocol and common DNS implementations facilitate a DNS cache poisoning attack that affects BIND, Microsoft Windows DNS services and CISCO IOS.