Subverting BIND's SRTT Algorithm: Derandomizing NS Selection

[Roee Hay <roeeh@xxxxxxxxxx>]

Hi,

BIND is exposed to a new vulnerability which can be exploited remotely
in order to derandomize the name server selection algorithm.
Exploitation of this vulnerability can be used in conjunction with
other off-path DNS cache poisoning exploits in order to make them more
efficient. ISC has acknowledged the vulnerability and plans to address
this deficiency by re-implementing the SRTT algorithm in future
maintenance releases of the BIND 9 code.

Important links:

1. Whitepaper: http://bit.ly/17LBSC1
2. Slides: http://bit.ly/17M3gj9
3. Blog post: http://ibm.co/17ntOIw
4. ISC's Operational Notification: http://bit.ly/1d3iR3z


-Roee