BIND users should check their configs to make sure they aren't restricting the source port.
Any lines like query-source port 53; query-source-v6 port 53; need to be commented out or deleted so that forwarded DNS queries come from random ports. RedHat have re-released their 5.x packages: http://rhn.redhat.com/errata/RHSA-2008-0533.html "[Updated 10th July 2008] We have updated the Enterprise Linux 5 packages in this advisory. The default and sample caching-nameserver configuration files have been updated so that they do not specify a fixed query-source port. Administrators wishing to take advantage of randomized UDP source ports should check their configuration file to ensure they have not specified fixed query-source ports." Cheers, Phil -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chandrashekhar B Sent: 10 July 2008 09:29 To: [email protected] Subject: [Full-disclosure] Multiple Vendor DNS Cache Poisoning issue We have a detailed advisory here, http://www.secpod.org/advisories/Multiple_Vendor_DNS_Spoofing_Vulnerabil ity_MS08_037.html Thanks, Chandra. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
