Detections
Analytics
Debian DSA-1605-1 : glibc - DNS cache poisoning
medium Nessus Plugin ID 33452
Synopsis
The remote Debian host is missing a security-related update.Description
Dan Kaminsky discovered that properties inherent to the DNS protocol lead to practical DNS spoofing and cache poisoning attacks. Among other things, successful attacks can lead to misdirected web traffic and email rerouting.Solution
At this time, it is not possible to implement the recommended countermeasures in the GNU libc stub resolver. The following workarounds are available :1. Install a local BIND 9 resolver on the host, possibly in forward-only mode. BIND 9 will then use source port randomization when sending queries over the network.
(Other caching resolvers can be used instead.)
2. Rely on IP address spoofing protection if available. Successful attacks must spoof the address of one of the resolvers, which may not be possible if the network is guarded properly against IP spoofing attacks (both from internal and external sources).
This DSA will be updated when patches for hardening the stub resolver are available.
Plugin Details
Severity: Medium
ID: 33452
File Name: debian_DSA-1605.nasl
Version: Revision: 1.14
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 7/10/2008
Updated: 12/28/2012
Supported Sensors: Continuous Assessment, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.0
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P
Vulnerability Information
CPE: cpe:/o:debian:debian_linux
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Reference Information
CVE: CVE-2008-1447