Patch domain name servers now, says DNS inventor

By Jaikumar Vijayan, Computerworld, 07/10/08

 Start a discussion    Print article

 Comments (1)    Print article

Paul Mockapetris, inventor of the Internet's Domain Name System architecture, has some advice for those in any doubt about the seriousness of a weakness in the DNS protocol that was disclosed yesterday: Patch your DNS servers right now.

The vulnerability and the attack it enables are among the most dangerous to have been discovered in the DNS protocol so far, Mockapetris said in an interview with Computerworld Wednesday morning.

"It's absolutely critical for IT managers to upgrade their software. They want to make very sure that the caching servers on their perimeters are up to snuff," Mockapetris said. In addition, they need to also ensure that client devices such as DSL modems that might have DNS software embedded in them are properly patched. "The time to fix is now. The clock is ticking," before exploits against the flaw become widely available, he said.

The so-called DNS cache-poisoning flaw was discovered by Dan Kaminsky, a researcher at security firm IOActive Inc. earlier this year. The vulnerability gives malicious attackers a way to very quickly redirect Web traffic and e-mails to systems under their control. Virtually every domain name server that resolves IP addresses on the Internet is vulnerable to the flaw, as are client devices with embedded DNS software.

According to Kaminsky's description of the problem, the weakness exists in a transaction identification process that the DNS protocol uses to determine whether responses to DNS queries are legitimate or not. The vulnerability essentially allows an attacker to poison a DNS server cache by injecting forged data into it.

The flaw exists at the DNS protocol level and affects numerous products from multiple vendors. The U.S. Computer Emergency Readiness Team (US-CERT), which was among the first to be informed about the problem when Kaminsky discovered it, yesterday issued an advisory describing the issue and listing over 80 vendors whose products are affected by the vulnerability. Several of those firms, including Microsoft Corp., Cisco Systems Inc., Sun Microsystems Inc., Red Hat Inc. and Nominum Inc., simultaneously released patches Wednesday.

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.

Featured Whitepapers

The Trend from UNIX to Linux in SAP(r) Data Centers

LinuxCast Listen to the latest Linux news.

About Us | Contact Us | Advertising Info | Terms of Service/Privacy

Copyright, 2006-2007 Network World, Inc. All rights reserved.