Description
The (1) NSID_SHUFFLE_ONLY and (2) NSID_USE_POOL PRNG algorithms in ISC BIND 8 before 8.4.7-P1 generate predictable DNS query identifiers when sending outgoing queries such as NOTIFY messages when answering questions as a resolver, which allows remote attackers to poison DNS caches via unknown vectors. NOTE: this issue is different from CVE-2007-2926.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- ISC BIND 8 - Remote Cache Poisoning (1) EDB-30535 · remote · Aug 27, 2007 · verified
- ISC BIND 8 - Remote Cache Poisoning (2) EDB-30536 · remote · Aug 27, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://support.avaya.com/elmodocs2/security/ASA-2007-448.htm
- 200859 vendor-advisory
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=653968
- ADV-2007-3936 vdb-entry
- 27433 third-party-advisory
- 20071001 Re: BIND 8 EOL and BIND 8 DNS Cache Poisoning (Amit Klein, Trusteer) mailing-list
- ADV-2007-3192 vdb-entry
- ADV-2007-2991 vdb-entry
- HPSBUX02289 vendor-advisory
- 26629 third-party-advisory
- 1018615 vdb-entry
- http://www.trusteer.com/docs/bind8dns.html
- 27459 third-party-advisory
- 25459 vdb-entry
- ADV-2007-3668 vdb-entry
- 27696 third-party-advisory
- http://www.isc.org/index.pl?/sw/bind/bind8-eol.php
- 20070827 BIND 8 EOL and BIND 8 DNS Cache Poisoning (Amit Klein, Trusteer) mailing-list
- 27465 third-party-advisory
- ADV-2007-3639 vdb-entry
- http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2007/43/022954-01.pdf
- 26858 third-party-advisory
- oval:org.mitre.oval:def:2154 vdb-entry signature
- VU#927905 third-party-advisory
- 103063 vendor-advisory
- http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3975
- R-333 third-party-advisory government-resource
- 20071006 Re: BIND 8 EOL and BIND 8 DNS Cache Poisoning (Amit Klein, Trusteer) mailing-list