<html>
<body>
<font size=3><br>
For the last several weeks Dan and others have been urging<br>
folks to upgrade. Dan is putting something out now, because the<br>
vulnerability was brought out in public. <br><br>
<br>
<blockquote type=cite class=cite cite="">Dear ISP:<br>
<br>
As you have probably read, a large collection of DNS vendors,
software<br>
publishers, and researchers published an update to their DNS servers
and<br>
clients. There is now publication of the details of vulnerability
which<br>
means exploit is more likely.<br>
<br>
The root cause of the vulnerability is a lack of entropy (randomness
if<br>
you will) in the UDP ports used by DNS. The updates randomize the
ports<br>
that are used by DNS.<br>
<br>
However, there is an issue
(<a href="http://blogs.iss.net/archive/dnsnat.html" eudora="autourl">
http://blogs.iss.net/archive/dnsnat.html</a>)<br>
that some NAT devices undo the randomization of the ports and
re-write<br>
the ports in a sequential number. This in effect
re-introduces the<br>
vulnerability to customers. Many customers are behind these
devices<br>
and customers using a low-end device are far less likely to
understand<br>
the issues compare to customers behind a more powerful router or<br>
firewall device. Obviously consumers are a likely group to be in
this<br>
situation, but so are SOHOs and other small and medium business<br>
customers.<br>
<br>
While the NAT device manufactures evaluate the situation and
determine<br>
what their response should be, there is one strong workaround.
It<br>
involves setting up your DNS in the way described here<br>
(<a href="http://www.isc.org/sw/bind/docs/forwarding.php).%A0" eudora="autourl">
http://www.isc.org/sw/bind/docs/forwarding.php). </a> This means that the
customer is relying on the ISP's server to be<br>
updated.<br>
<br>
Therefore I am urging all ISPs to make sure they update their
servers,<br>
and encourage their users to update their systems.<br>
<br>
For more information you can go to my research page:<br>
<a href="http://www.doxpara.com/" eudora="autourl">
http://www.doxpara.com/</a><br>
<br>
<br>
Dan Kaminsky<br>
IO Active<br>
<br><br>
-- <br><br>
<br><br>
No virus found in this incoming message.<br>
Checked by AVG -
<a href="http://www.avg.com/" eudora="autourl">http://www.avg.com</a>
<br>
Version: 8.0.138 / Virus Database: 270.5.3/1565 - Release Date: 7/21/2008
6:36 PM</font></blockquote></body>
</html>