Re: After 6 months - fix available for Microsoft DNS cache poisoning attack

1 msg	[ GLSA 200805-08 ] InspIRCd: Denial of Service
6 msg	Apache Server HTML Injection and UTF-7 XSS Vuln...
1 msg	[USN-611-3] GStreamer Good Plugins vulnerability
1 msg	[USN-611-2] vorbis-tools vulnerability
1 msg	FLEA-2008-0008-1 firefox
1 msg	[USN-611-1] Speex vulnerability
1 msg	ezContents CMS Version 2.0.0 SQL Injection Vuln...
1 msg	iDefense Security Advisory 05.07.08: Multiple V...
1 msg	ZYWALL Referer Header XSS Vulnerability
1 msg	iDefense Security Advisory 05.07.08: Multiple V...
1 msg	iDefense Security Advisory 05.07.08: Multiple V...
1 msg	[ GLSA 200805-04 ] eGroupWare: Multiple vulnera...

Re: After 6 months - fix available for Microsof...
\ rick.a.cook (8 May 2008)
. \ Amit Klein (8 May 2008)

1 msg	Novell Client <= 4.91 SP4 Local Stack overfl...
9 msg	Exploiting Google MX servers as Open SMTP Relays
1 msg	Vulnerability in Multiple Web Application
1 msg	VBZooM <=V1.11 'reply.php' SQL Injection Vul...
1 msg	Multiple XSS In TuxCMS All Version
1 msg	[ GLSA 200805-03 ] Multiple X11 terminals: Loca...
1 msg	[USN-610-1] LTSP vulnerability

Subject:	Re: After 6 months - fix available for Microsoft DNS cache poisoning attack
Group:	Bugtraq
From:	Amit Klein
Date:	8 May 2008

rick.a.cook wrote:
> After implementing this patch on a large scale network, it was discovered that this patch caused a dns memory leak. Microsoft has since corrected this issue with a private fix.

Amusing. They pulled the fix from being released in October at the last
minute, quoting memory leaks. I guess they didn't fully address it after
all...

> Even worse, in my large enterprise, this patch caused the exact spoofing that it intended to prevent. Somehow the code to increase the entropy has caused random xid's to cross and spoof randomly, poisioning the cache through normal usage without the use of extracurricular programs. I've reported this to Microsoft and have been working with them in fixing this issue, which to date has not been fixed.
>

Sounds like they just draw a random number each time, regardless of the
history (i.e. of previously drawn numbers), which can cause collisions
(I think that's the phenomenon you describe). BIND 9 has a mechanism
that ensures that collisions are discarded. OpenBSD retains history of
the last 32K (IIRC) numbers used, and does not re-use those numbers.
PowerDNS randomizes UDP source ports, so it considerably reduces
collision likelihood. I guess MS didn't implement any such mechanism (I
don't know for sure because I never reviewed their solution - I didn't
get a preview version from MS).

Thanks,
-Amit