Internetin belkemigi protokolu DNS servisidir. Bu servisin aksamasi ile buna bagli tum internet servislerinde(Mail, web, vs) problem yasanir.
Gecenlerde DNS sunucu yazilimlari arasinda en fazla tercih edilen Isc BIND ile ilgili bir guvenlik zaafiyeti yayinlandi(Bind 9 DNS cache Poisoning). Detaylarina buradan ulasabileceginiz bu acik Bind kullanan tum Linux/UNIX dagitimlarini da etkiledigi icin ISC tarafindan hemen yamasi cikarildi(*). .
Guvenlik listelerine gelen Linux/Unix dagitimlarinin guncelleme maillerine bakarken acaba OpenBSD’de bu aciktan etkileniyıor mu diye dusundum , dusunmeye kalmadan birileri @misc listesine konu ile ilgili bir aciklama gondermis…
—
as some of you may have noticed, a new weakness in BIND 9 has recently been discovered. using this weakness, an attacker can remotely poison the cache of any BIND 9 server. the attacker can do this due to a weakness in the transaction ID generation algorithm used.
when BIND 9 was first imported into OpenBSD, we decided not to use the default ID generation algorithm (LFSR, Linear Feedback Shift Register) but to use a more proven algorithm (LCG, Linear Congruential Generator) instead. thanks to this wise decision, the BIND 9 shipped with OpenBSD does not have this weakness.
–Jakob schlyter
Kisacasi OpenBSD bunyesine aldigi yazilimlari oldugu gibi degil, kendi guvenlik kritilerlerini uyguladiktan sonra aliyor bu da sonradan cikabilecek bircok guvenlik acigini daha problem olmadan bitiriyor.
*Disclosure Timeline
May 29th, 2007 – ISC were notified via email.
July 2007 – ISC releases a fixed version. Simultaneously, Trusteer discloses the vulnerability to the public (in the form of this document).
