Greg YoungMy colleague and guest blogger Lawrence Orans joins me today in giving his take on the DNS BIND vulnerability:
Another July, another DNS vulnerability. Last year, it was the Kaminsky vulnerability. Yesterday, the ISC announced another vulnerability in BIND. It’s serious — a specially-crafted dynamic update message can crash your BIND 9 name servers. According to the ISC, “an active remote exploit is in wide circulation at this time”. Fortunately, the ISC has released BIND versions which address the vulnerability. BIND users should upgrade immediately to one of the three BIND 9 versions specified in the ISC announcement.
I can count on one hand the number of Gartner clients that scheduled inquiries with us last year to discuss the Kaminsky vulnerability. At first, that surprised me. But, after thinking about it, I realized that clients weren’t calling because there really wasn’t anything to discuss. If you were running a vulnerable version of DNS, you had to apply the patch – it’s that simple. You don’t ask the dentist if you need to brush your teeth, and you don’t need to ask Gartner if you should patch the Kaminsky DNS vulnerability. I imagine that with this DNS vulnerability, Gartner will also see a similar lack of inquiries from our clients. Sure, two serious DNS vulnerabilities in two years will stimulate lots of discussion and debate about best practices for securing DNS, but the immediate priority is to get those BIND 9 name servers upgraded – there is no need to discuss that. So, go out there and brush (and floss) your teeth!
- Lawrence Orans is a research director in Gartner’s Research organization. His research focuses on the integration of security within internal networks, with a particular emphasis on network access control, VoIP and content filtering.
Category: Uncategorized Tags:
2 responses so far ↓
1 DNS Bind Vulnerability Requires Action | Hack In The Box July 29, 2009 at 5:20 pm
[...] the rest here: DNS Bind Vulnerability Requires Action Share and [...]
2 Followup Friday: Responsible Users? Patch Plethora Problems? In a BIND Bind? Safer Eensy Beensy URLs? July 31, 2009 at 8:47 am
[...] Update to “Security Issues of Top Level DNS Redirection“: Lots of positive movement on DNSEC in recent weeks, including publicity for the open source DNSSEC project. But of course, this week there were also warnings about yet another vulnerability in the BIND DNS software. Lawrence Orans of Gartner blogged about this here. [...]