Feeds

Caching bugs exposed in second biggest DNS server

Birthday Paradox stumps djbdns

High performance access to file storage

For years, cryptographer Daniel J. Bernstein has touted his djbdns as so secure he promised a $1,000 bounty to anyone who can poke holes in the domain name resolution software.

Now it could be time to pay up, as researchers said they've uncovered several vulnerabilities in the package that could lead end users to fraudulent addresses under the control of attackers.

djbdns is believed to be the second most popular DNS program, behind Bind. The bugs show that even the most secure DNS packages are susceptible to attacks that could visit chaos on those who use them.

One of the bugs, disclosed last week by researcher Kevin Day, exploits a known vulnerability in the DNS system that allows attackers to poison domain name system caches by flooding a server with multiple requests for the same address.

It was discovered in 2002 and applies a much older probability theory known as the Birthday Paradox. This holds that for a group of 23 randomly chosen people, there is a better than 50-per-cent probability that some pair will have been born on the same day and a better than 99-per-cent chance if the group is expanded to 57 people.

Attackers can exploit the condition by sending as few as 200 simultaneous domain-name requests to a server running djbdns. Under certain conditions, the DNS software will then return fraudulent IP addresses for that particular website address, according to this paper (PDF), which describes the attack in detail. Bind and other DNS programs added protection against the exploit years ago, so it was surprising when the vulnerability was only recently detected in Bernstein's package.

"We've known for seven years that you have to prevent simultaneous queries for the same name," DNS-security expert Dan Kaminsky told The Register. "They [the people responsible for djbdns] didn't and so they lost a fair amount of their security from that."

Neither Bernstein nor Day were available to comment for this story.

A second vulnerability in djbdns was disclosed on Thursday that could also be used to trick servers into returning spoofed addresses for popular websites. Discovered by Matthew Dempsky, a software engineer at Mochi Media, it works by manipulating a feature that shortens long addresses by omitting repeated domains in certain cases.

The exploit works only when users are running djbdns companion packages known as axfrdns and tinydns, which Dempsky said is fairly rare. Nonetheless, those who use such configurations to serve authoritative DNS content should patch immediately, Dempsky said. (More details are available here.)

To be sure, these bugs are nothing like last year's DNS cache poisoning vulnerability that threatened trust as we know it on the internet. That bug, and similar ones uncovered over the years by researchers such as Amit Klein, were so wide spread that they had the potential to afflict much bigger numbers and there were fewer mitigating circumstances.

At time of writing, it was unclear if the discoveries would qualify for the $1,000 bounty Bernstein has promised to pay.

"I think it does," Dempsky said of the vulnerability he disclosed. "I emailed him [Bernstein] earlier this week when I first discovered the bug to ask him about it. He replied that he would evaluate it and get back to me, but probably not until next week." ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
Oz bank in comedy Heartbleed blog FAIL
Bank: 'We are now safely patched.' Customers: 'You were using OpenSSL?'
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.