The Domain Name System is supposed to have its own security system, but it looks like that system itself has been found vulnerable yet again. eSecurity Planet gets the details.
DNS Security Extensions is supposed to be the technology that helps to secure the Domain Name System, or DNS, against attack. Yet DNSSEC servers aren’t always infallible, as a pair of vulnerabilities proved this week.
While it’s critical to the operation of the Internet as a whole, DNS came under intense scrutiny in 2008 after security researcher Dan Kaminsky disclosed that it was at risk from a widespread vulnerability. Developing a long-term solution to DNS security problems is what the creation of DNSSEC is all about.
Yet, this week, researchers identified DNSSEC itself as being at risk from a cache-poisoning attack.
Specifically, the widely deployed BIND DNS server’s DNSSEC implementation was identified as being at risk from a DNSSEC-validation vulnerability. The ISC (Internet Systems Consortium), which is the lead group behind the development of BIND, has now issued patches for the affected BIND servers.