Re: djbdns/dnscache poisoning weakness

Emilio Perea <[email protected]> wrote:
> Does dnscache forget only the SOA record but caches the glue?  Does the
> glue address record for ns1.example.com obtained from the example.com.
> server override the cached address already obtained from the com.
> server?

Yes.  When a response is received for an outstanding query, all
non-SOA records (not just glue) from that response are cached,
overriding any previously cached records.  An attacker can send an SOA
query, and then send forged responses answering dnscache's outgoing
query, with arbitrary extra records included in the forged responses.
As long as the extra records are within the bailiwick of the server
that dnscache was querying, they'll be cached (assuming the attacker
hits the right port and queryid).

> But then the poison would be flushed by the first SOA query after
> the attack ends, right?

First, SOA queries aren't very common.  Second, a legitimate SOA
response won't include extra records unrelated to the query, so if the
attacker poisoned the A record for www.example.com, a legitimate SOA
response for example.com won't correct that.  Third, if the attacker
poisoned the NS/glue records, dnscache will send all further queries
to the attacker's server, so it won't get any legitimate responses.


paul