Sign in / up

* Posts by John

2 publicly visible posts • joined 2 Aug 2008

Apple DNS patch doesn't patch Mac clients

John

get your facts right,

Taken from http://support.apple.com/kb/HT2647

BIND

CVE-ID: CVE-2008-1447

Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.4, Mac OS X Server v10.5.4

Impact: BIND is susceptible to DNS cache poisoning and may return forged information

Description: The Berkeley Internet Name Domain (BIND) server is distributed with Mac OS X, and is not enabled by default. When enabled, the BIND server provides translation between host names and IP addresses. A weakness in the DNS protocol may allow remote attackers to perform DNS cache poisoning attacks. As a result, systems that rely on the BIND server for DNS may receive forged information. This update addresses the issue by implementing source port randomization to improve resilience against cache poisoning attacks. For Mac OS X v10.4.11 systems, BIND is updated to version 9.3.5-P1. For Mac OS X v10.5.4 systems, BIND is updated to version 9.4.2-P1. Credit to Dan Kaminsky of IOActive for reporting this issue.

So to paraphrase, turned off, yet has been updated for both server and client. Which is the opposite of what you said.

Paris because thats the current level of the register research and reporting. Can I suggest they patch with britney.

0 0

Black hats attack gaping DNS hole

John
Thumb Down

Virgin Media

194.168.8.110 (winn-dnsbep-2.server.virginmedia.net) appears to have POOR source port randomness and GREAT transaction ID randomness.

80.3.64.148 (brig-dnsany-1.server.virginmedia.net) appears to have POOR source port randomness and GREAT transaction ID randomness.

194.168.8.109 (winn-dnsbep-1.server.virginmedia.net) appears to have POOR source port randomness and GREAT transaction ID randomness.

0 0