The DNS resolver in unspecified versions of Infoblox DNS One, when resolving recursive DNS queries for arbitrary hosts, allows remote attackers to conduct DNS cache poisoning via a birthday attack that uses a large number of open queries for the same resource record (RR) combined with spoofed responses, which increases the possibility of successfully spoofing a response in a way that is more efficient than brute force methods.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Dns_one | Infoblox | * | * |
| Bind | Isc | 4.9 (including) | 4.9 (including) |
| Bind | Isc | 4.9.2 (including) | 4.9.2 (including) |
| Bind | Isc | 4.9.3 (including) | 4.9.3 (including) |
| Bind | Isc | 4.9.4 (including) | 4.9.4 (including) |
| Bind | Isc | 4.9.5 (including) | 4.9.5 (including) |
| Bind | Isc | 4.9.5-p1 (including) | 4.9.5-p1 (including) |
| Bind | Isc | 4.9.6 (including) | 4.9.6 (including) |
| Bind | Isc | 4.9.7 (including) | 4.9.7 (including) |
| Bind | Isc | 4.9.8 (including) | 4.9.8 (including) |
| Bind | Isc | 4.9.9 (including) | 4.9.9 (including) |
| Bind | Isc | 4.9.10 (including) | 4.9.10 (including) |
| Bind | Isc | 8.2 (including) | 8.2 (including) |
| Bind | Isc | 8.2.1 (including) | 8.2.1 (including) |
| Bind | Isc | 8.2.2 (including) | 8.2.2 (including) |
| Bind | Isc | 8.2.2-p1 (including) | 8.2.2-p1 (including) |
| Bind | Isc | 8.2.2-p2 (including) | 8.2.2-p2 (including) |
| Bind | Isc | 8.2.2-p3 (including) | 8.2.2-p3 (including) |
| Bind | Isc | 8.2.2-p4 (including) | 8.2.2-p4 (including) |
| Bind | Isc | 8.2.2-p5 (including) | 8.2.2-p5 (including) |
| Bind | Isc | 8.2.2-p6 (including) | 8.2.2-p6 (including) |
| Bind | Isc | 8.2.2-p7 (including) | 8.2.2-p7 (including) |
| Bind | Isc | 8.2.3 (including) | 8.2.3 (including) |
| Bind | Isc | 8.2.4 (including) | 8.2.4 (including) |
| Bind | Isc | 8.2.5 (including) | 8.2.5 (including) |
| Bind | Isc | 8.2.6 (including) | 8.2.6 (including) |
| Bind | Isc | 8.2.7 (including) | 8.2.7 (including) |
| Bind | Isc | 8.3.0 (including) | 8.3.0 (including) |
| Bind | Isc | 8.3.1 (including) | 8.3.1 (including) |
| Bind | Isc | 8.3.2 (including) | 8.3.2 (including) |
| Bind | Isc | 8.3.3 (including) | 8.3.3 (including) |
| Bind | Isc | 8.3.4 (including) | 8.3.4 (including) |
References
- http://www.imconf.net/imw-2002/imw2002-papers/198.pdf
- http://www.kb.cert.org/vuls/id/457875
- http://www.kb.cert.org/vuls/id/IAFY-5FDPYJ
- http://www.rnp.br/cais/alertas/2002/cais-ALR-19112002a.html
- http://www.imconf.net/imw-2002/imw2002-papers/198.pdf
- http://www.kb.cert.org/vuls/id/457875
- http://www.kb.cert.org/vuls/id/IAFY-5FDPYJ
- http://www.rnp.br/cais/alertas/2002/cais-ALR-19112002a.html