Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

For years, cryptographer Daniel J. Bernstein has touted his djbdns as so secure he promised a $1,000 bounty to anyone who can poke holes in the domain name resolution software.

Now it could be time to pay up, as researchers said they've uncovered several vulnerabilities in the package that could lead end users to fraudulent addresses under the control of attackers.

One of the bugs, disclosed last week by researcher Kevin Day, exploits a known vulnerability in the DNS system that allows attackers to poison domain name system caches by flooding a server with multiple requests for the same address.

It was discovered in 2002 and applies a much older probability theory known as the Birthday Paradox. This holds that for a group of 23 randomly chosen people, there is a better than 50-per-cent probability that some pair will have been born on the same day and a better than 99-per-cent chance if the group is expanded to 57 people.

Attackers can exploit the condition by sending as few as 200 simultaneous domain-name requests to a server running djbdns. Under certain conditions, the DNS software will then return fraudulent IP addresses for that particular website address, according to this paper (PDF), which describes the attack in detail. Bind and other DNS programs added protection against the exploit years ago, so it was surprising when the vulnerability was only recently detected in Bernstein's package.

"We've known for seven years that you have to prevent simultaneous queries for the same name," DNS-security expert Dan Kaminsky told The Register. "They [the people responsible for djbdns] didn't and so they lost a fair amount of their security from that."

Neither Bernstein nor Day were available to comment for this story.

A second vulnerability in djbdns was disclosed on Thursday that could also be used to trick servers into returning spoofed addresses for popular websites. Discovered by Matthew Dempsky, a software engineer at Mochi Media, it works by manipulating a feature that shortens long addresses by omitting repeated domains in certain cases.

The exploit works only when users are running djbdns companion packages known as axfrdns and tinydns, which Dempsky said is fairly rare. Nonetheless, those who use such configurations to serve authoritative DNS content should patch immediately, Dempsky said. (More details are available here.)

To be sure, these bugs are nothing like last year's DNS cache poisoning vulnerability that threatened trust as we know it on the internet. That bug, and similar ones uncovered over the years by researchers such as Amit Klein, were so wide spread that they had the potential to afflict much bigger numbers and there were fewer mitigating circumstances.

At time of writing, it was unclear if the discoveries would qualify for the $1,000 bounty Bernstein has promised to pay.

"I think it does," Dempsky said of the vulnerability he disclosed. "I emailed him [Bernstein] earlier this week when I first discovered the bug to ask him about it. He replied that he would evaluate it and get back to me, but probably not until next week." ®

Agentless Backup is Not a Myth