Re: djbdns/dnscache poisoning weakness

On Feb 9, 2009, at 4:30 PM, Matthew Dempsky wrote:

> On Mon, Feb 9, 2009 at 11:41 AM, Kevin Day <[email protected]> wrote:
>> 1) Dnscache treats "SOA" requests as uncacheable.
>
> It's worth noting that dnscache from djbdns-1.05 also does not cache
> negative CNAME responses.  E.g., it will always forward CNAME queries
> for "google.com" because that name does not have a CNAME record.
> Jonathan de Boyne Pollard pointed this out at
> http://homepages.tesco.net/J.deBoynePollard/FGA/djbdns-problems.html#dnscache-cname-handling 
> .

When I get back into the office in the morning, I'll dig up my notes  
from when I first looked at all of this. I seem to remember coming to  
the decision that this wasn't exploitable for one reason or another.

That said, if you're watching from the sidelines.... The SOA fix (or  
this CNAME issue) is relatively minor compared to the duplicate query  
prevention. Being able to issue the same request over and over again  
doesn't buy you that much compared to the existing "Kaminsky" style  
attack which still works. The serious issue is the ability to launch  
200 of the same query at once, making poisoning extremely quick no  
matter what your query type is. Issues like this make it slightly  
easier, but the duplicate query patch is what actually solves the  
problem.

-- Kevin