FreeBSD -- DNS cache poisoning

ID 655EE1EC-511B-11DD-80BA-000BCDF0A03B
Type freebsd
Reporter FreeBSD
Modified 2016-08-09T00:00:00


Problem Description: The BIND DNS implementation does not randomize the UDP source port when doing remote queries, and the query id alone does not provide adequate randomization. Impact: The lack of source port randomization reduces the amount of data the attacker needs to guess in order to successfully execute a DNS cache poisoning attack. This allows the attacker to influence or control the results of DNS queries being returned to users from target systems. Workaround: Limiting the group of machines that can do recursive queries on the DNS server will make it more difficult, but not impossible, for this vulnerability to be exploited. To limit the machines able to perform recursive queries, add an ACL in named.conf and limit recursion like the following: acl example-acl {; }; options { recursion yes; allow-recursion { example-acl; }; };