I read about this a little while ago, but here is more info. It is worth the read.
Gil -----Original Message----- From: Chris Karr [mailto:[EMAIL PROTECTED] Sent: Friday, July 11, 2008 8:31 AM To: Chris Karr Subject: Massive DNS Flaw reported by CERT Folks, This is an FYI .. http://news.yahoo.com/s/afp/20080709/tc_afp/usitinternetsoftwarecrime;_ylt=A http://www.us-cert.gov/current/#dns_implementations_vulnerable_to_cache DNS Implementations Vulnerable to Cache Poisoning added July 8, 2008 at 03:37 pm US-CERT is aware of deficiencies in the DNS protocol. Implementations of this protocol may leave the affected system vulnerable to DNS cache poisoning attacks. If an attacker can successfully conduct a cache poisoning attack, they may be able to cause a nameserver's clients to contact the incorrect, and possibly malicious, hosts for particular services. This may allow an attacker to obtain sensitive information or mislead users into believing they are visiting a legitimate website. US-CERT encourages users to review "VU#800113 - Multiple DNS implementations vulnerable to cache poisoning" and apply any necessary solutions listed in that document to help mitigate the risks. US-CERT will provide additional information as it becomes available. ~Chris Christopher B. Karr, CISSP President ÜberGuard Information Security Consulting, LLC 91 Clinton St. Avon, NY 14414 Direct: (585) 226-2635 Mobile: (585) 703-9774 Fax: (585) 226-9329 [EMAIL PROTECTED] www.uberguard.com We protect your business to keep you in business Confidentiality Notice: The information contained in this e-mail and any attachments may be legally privileged and confidential. If you are not an intended recipient, you are hereby notified that any dissemination, distribution or copying of this e-mail is strictly prohibited. If you have received this e-mail in error, please notify the sender and permanently delete the e-mail and any attachments immediately. You should not retain, copy or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person. --- StripMime Report -- processed MIME parts --- multipart/alternative text/plain (text body -- kept) text/html --- _______________________________________________ Post Messages to: [email protected] Subscription Maintenance: http://leafe.com/mailman/listinfo/profox OT-free version of this list: http://leafe.com/mailman/listinfo/profoxtech Searchable Archive: http://leafe.com/archives/search/profox This message: http://leafe.com/archives/byMID/profox/[EMAIL PROTECTED] ** All postings, unless explicitly stated otherwise, are the opinions of the author, and do not constitute legal or medical advice. This statement is added to the messages for those lawyers who are too stupid to see the obvious.
