BIND9のDNSキャッシュ汚染

BIND9にDNSキャッシュ汚染の脆弱性だそうです。

The paper shows that BIND 9 DNS queries are predictable – i.e. that the source UDP port and DNS transaction ID can be effectively predicted. A predictability algorithm is described that, in optimal conditions, provides very few guesses for the “next” query (10 in the basic attack, and 1 in the advanced attack), thereby overcoming whatever protection offered by the transaction ID mechanism. This enables a much more effective DNS cache poisoning than the currently known attacks against BIND 9. The net effect is that pharming attacks are feasible against BIND 9 caching DNS servers, without the need to directly attack neither DNS servers nor clients (PCs). The results are applicable to all BIND 9 releases [1], when BIND (the named daemon) is in caching DNS server configuration.

まだ中身を見れていないのですが、最適な条件であれば基本的な攻撃で10回、高度な攻撃で1回で次のトランザクションIDを推測できる、としています。最適な条件がどれくらいあるのか？は読んでみないとわからないです。

All stable versions of BIND 9 to date (except the ones released simultaneously with this paper) are vulnerable, i.e. BIND 9 versions 9.4.0-9.4.1, 9.3.0-9.3.4, 9.2.0-9.2.8, 9.1.0-9.1.3 and 9.0.0-9.0.1.

とあるので、BIND9の最新版では問題は修正されているそうです。 http://www.isc.org/index.pl を見ると確かに今月リリースの9.xが紹介されています。

CVEはこれ
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2926

BIND8, BIND4には影響がないとされています。