Re: Permitting recursion can allow spammers to steal name server resources

["Dan Harkless" <bugtraq@xxxxxxxxxxxx>]

On September 9, 2003, Chris Brenton <cbrenton@xxxxxxxxxxxxxxxx> wrote:
[...]
> "DNS Cache Poisoning - The Next Generation" by by Joe Stewart, GCIH
> http://www.securityfocus.com/guest/17905
[...]
> _Fixing the problem with Bind_

You aren't making any distinction between different versions of BIND, but
you probably should be.  The traditional easy cache poisoning attack using
extra records in the "ADDITIONAL" section is resisted by BIND 9, but BIND 4
and 8 are still vulnerable, IIRC.  Against BIND 9 you'd have to use address,
port, and transaction ID spoofing, as Joe Stewart discusses in his article,
which raises the bar for entry quite a bit.

> Changing Bind so that it will not act recursively for all hosts on the 
> Internet is a relatively simple process. Edit the /etc/named.conf file 
> to add in the "allow-recursion" parameter similar to the following:
> 
> options {
>          directory "/var/named";
>          allow-recursion {localnets; };
> };
[...]
> allow-recursion {172.16.1.1, 10.0.0.0/8, 192.168.1.0/24;};

As has been pointed out before, this still leaves you potentially open to
cache poisoning if the attacker can spoof those addresses (and again, the
attacker will need to be spoofing anyway, if attacking BIND 9).

The safest setup is to run authoritative nameservers on separate machines
(or at least IPs) from caching recursive servers, as discussed, e.g. here:

    http://cr.yp.to/djbdns/separation.html

--
Dan Harkless
bugtraq@xxxxxxxxxxxx
http://harkless.org/dan/