DNS Multiple Race Exploiter simiplifies exploitation of the latest DNS vulnerability and even attempts to poison patched servers. According to the author:

Patched DNS servers randomize the UDP source port number, however, that will not eliminate the flaw; it will only increase the time required to poison the cache. Poisoning unpatched systems would take a period seconds, however, poisoning patched systems would take a period of hours.

Unlike the previously released tools that work on poisioning uncached “NS” and “A” records, this tool can overwrite any A record by using a CNAME response. 

The tool uses a static TTL of 0x7BEDABED in all spoofed replies, which should be sufficient to create an IDS/IPS signature to protect against the script kiddies out there.

cname_rr = (struct cname_RR *) (payload + sizeof(struct dns_hdr) + hostname->size + sizeof(struct query_RR));
cname_rr->name = htons(0xC00C);
cname_rr->type = htons(0×0005);
cname_rr->clss = htons(0×0001);
cname_rr->ttl = htonl(0x7BEDABED);
cname_rr->length = htons(entryname->size);

PA Vietnam, a Vietnam Government affiliate and the second largest hosting company in the country, saw over 10,000 websites being crippled after the provider’s .COM and .NET Top Level Domains (TLDs) were hijacked by attackers on Sunday, 27th of July. The crippled websites used the provider’s domain name servers (DNS) that were registered under the hijacked domains. 

According to VNCERT, the country’s National Computer Emergency Response Team:

“It’s believed the hackers broke in through a hole in DNS to control the administration,”
-VNCERT Technical Branch Chief –  Do Ngoc Duy Trac. (more…)

Metasploit team has published two modules that exploit the recently announced DNS flaw. These are named “DNS BailiWicked Host Attack” for injecting individual uncached host records into the target nameserver’s cache, and “DNS BailiWicked Domain Attack” for replacing a target domain’s nameserver records in a target nameserver’s cache.

The above two modules require you run Metasploit Framework from the “trunk” development branch which is currently only supported on the Linux platform.

Here’s more from the official blog:

The first flaw is that since DNS (over UDP) is connectionless, it can easily be spoofed. The original primary mitigation against this was to make use of a 16-bit transaction ID which is used to correlate requests and replies that the attacker would have to guess in order to correctly spoof a reply packet. This makes spoofing harder, but not an insurmountable task; you just need to be able to send a whole lot of packets to eventually get one right at match the transaction ID chosen for the request packet.

The second flaw was that additional records would be inserted into the cache which were included in replies from another nameserver. This is core protocol functionality, however the original problem was somewhat mitigated by creating the in-bailiwick constraints that essentially limits the domain space for additional records that could be sent in the replies to hostnames from a given domain. Sounds reasonable; this prevents nameservers from doing malicious things to records in domains that they weren’t queried for or aren’t authoritative for, while still allowing nameservers who are authoritative for a domain to update the records they need to.

When you combine the attacks for these two flaws however, and introduce nameserver query recursion, an attacker can essentially cause the target nameserver to make as many queries as the attacker wants while also pretending to be the authoritative nameserver and spoofing the responses, achieving the birthday attack against the transaction ID and successfully updating the nameserver record for a domain to point to a malicious nameserver address. You can also use this trick to inject cache entries for individual hostname records as long as those hostnames are both not already cached, and also in-bailiwick.

(more…)