Paper by Amit Klein (Trusteer): "PowerDNS Recursor DNS Cache Poisoning [pharming]"
Hello BugTraq
Once again, a DNS cache poisoning against a popular DNS cache
server. This time, it's PowerDNS (the third most popular DNS
server, servicing over 40 million users). The vendor coded
several impressive security measures against DNS spoofing (e.g.
UDP source port randomization and spoofed response detection),
but relied on the standard C randomization facility (the rand()
and srand() functions in <stdlib.h>). The two popular stdlib
implementations analyzed, glibc (used with GNU C++ for Linux/
Unix-like systems) and MSVCRT (used with Microsoft's MSVC for
Windows) are shown to be easily predictable, thus enabling an
attacker to predict the DNS queries sent by PowerDNS Recursor,
and in turn mount an efficient and effective DNS cache poisoning
attack (or a pharming attack, as it is often called today).
PowerDNS's security contact, Bert Hubert, responded in a quick
and professional manner - an immediate fix was silently
incorporated (with my blessing) in Recursor 3.1.5-snapshot5 which
was released less than 6 hours after the initial report. A stable
version, Recursor 3.1.5, that "officially" includes the fix, is
announced today, and is available for immediate download (see
http://doc.powerdns.com/powerdns-advisory-2008-01.html).
The full analysis can be found in the following link:
http://www.trusteer.com/docs/powerdnsrecursor.html
Thanks,
-Amit
CTO, Trusteer