Bug 125434

(Taken from the ISC advisory)

A weakness in the DNS protocol may enable the poisoning of caching recurive resolvers with spoofed 
data. DNSSEC is the only full solution. New versions of BIND provide increased resilience to the 
attack.

Thanks to recent work by Dan Kaminsky of IOActive, ISC has become aware of a potential attack 
exploiting weaknesses in the DNS protocol itself. (Full details of the vulnerability will be 
explained by Kaminsky at the Black Hat conference on August 7th.) The weakness is inherent to the DNS 
protocol and not specific to any single implementation. The DNS protocol uses the Query ID field to 
match incoming responses to previously sent queries. The Query ID field is only 16 bits, which makes 
it an easy target to exploit in the particular spoofing scenario described by Kaminsky. 

ANYONE RUNNING BIND AS A CACHING RESOLVER IS AFFECTED.

Fix: 

IF YOU ARE RUNNING BIND AS A CACHING RESOLVER YOU NEED TO TAKE ACTION.

YOU ARE ADVISED TO INSTALL EITHER THE PATCHES (9.5.0-P1, 9.4.2-P1, 9.3.5-P1) OR THE NEW BETA RELEASES 
(9.5.1b1, 9.4.3b2) IMMEDIATELY.

The patches will have a noticeable impact on the performance of BIND caching resolvers with query 
rates at or above 10,000 queries per second. The beta releases include optimized code that will 
reduce the impact in performance to non-significant levels.

DNS administrators who operate these servers behind port-restricted firewalls are encouraged to 
review their firewall policies to allow this protocol-compliant behavior. Restricting the possible 
use of various UDP ports, for instance at the firewalls, in outgoing queries and the corresponding 
replies will result in decreased security for the DNS service.