 espaethDigital PlumberPremium,MVM
join:2001-04-21
Minneapolis, MN
kudos:2
 ·Clear Wireless
| reply to rolfp
Re: just copy/pastin' my way through life said by rolfp:OK, however, the folks at the thread in ATU I link are reporting 'GOOD' results when they apply the patch or update their dns server software. Wouldn't such a 'GOOD' result be expected from a patched Comcast server It would depend on what DNS server it is. These tools are for testing Bind, so they are assuming Bind post-patch behavior. The 3 key problems with Bind specifically are:
1) Transaction IDs were predictable
2) Source ports were predictable
3) There was no limit to the number of response "attempts" that would be processed for a query before a valid response is received.
For this exploit to work, you need to get a spoofed response packet shot into the DNS server before the real server's packet made it in. With bind you could predict what the next source port and transaction ID would be, so once you saw one query you could predict what the next would be. |
