Re: djbdns/dnscache poisoning weakness

On Thu, Feb 12, 2009 at 11:38 AM, Paul Jarc <[email protected]> wrote:
> So getting a forged response in for one of the first 199 queries
> doesn't help to poison the record asked about, since that cache entry
> will quickly be overwritten by a subsequent response for a duplicate
> query.

No, because dnscache drops the oldest active query when it's already
at the max and it receives a new inbound query.  Assuming there's a
100ms round-trip between dnscache and the authoritative nameservers
for the domain being targeted, you send on average more than one new
query to dnscache every 0.5ms, so that by time any legitimate
responses reach dnscache, the corresponding query slot has been
recycled.

Once you've poisoned dnscache, you can send it a batch of 200
unimportant queries so that it recycles all existing query slots and
will then disregard any legitimate responses.