Subject: [DNSOP] [Dailydave] DNS Poisoning via Port Exhaustion (fwd)

From: Paul Wouters <[email-masked]>
Date: Tue, 18 Oct 2011 23:42:24 -0400 (EDT)

FYI

Paul

---------- Forwarded message ----------
Date: Tue, 18 Oct 2011 17:14:56
From: Roee Hay <[email-masked]>
To: dailydave <[email-masked]>
Subject: [Dailydave] DNS Poisoning via Port Exhaustion
X-Spam-Flag: NO

Hey,

Today we are releasing a very interesting whitepaper which describes a DNS
poisoning attack against stub resolvers.

It discloses two vulnerabilities:

1. A vulnerability in Java (CVE-2011-3552, CVE-2010-4448) which enables remote
  DNS poisoning using Java applets. This vulnerability can be triggered when
  opening a malicious webpage. A successful exploitation of this vulnerability
  may lead to disclosure and manipulation of cookies and web pages, disclosure
  of NTLM credentials and clipboard data of the logged-on user, and even
  firewall bypass.

2. A vulnerability in multiuser Windows environments which enables local DNS
  cache poisoning of arbitrary domains. This vulnerability can be triggered
  by a normal user (i.e. one with non-administrative rights) in order to
  attack other users of the system. A successful exploitation of this
  vulnerability may lead to information disclosure, privilege escalation,
  universal XSS and more.

 Whitepaper: http://bit.ly/q31wSq
 A blog post with video demos: http://bit.ly/qu4Ez7

Roee Hay <[email-masked]>, IBM Rational Application Security Research Group
Yair Amit <[email-masked]>
_______________________________________________
Dailydave mailing list
[email-masked]
https://lists.immunityinc.com/mailman/listinfo/dailydave

---

From: Mark Andrews <[email-masked]>
Date: Wed, 19 Oct 2011 15:06:01 +1100

In message <[email-masked]>, Paul Woute
> Paul

Nothing really new here.  Port exhaustion was a obvious and identified
threat when we looked at port randomisation.

> 1. A vulnerability in Java (CVE-2011-3552, CVE-2010-4448) which enables rem=
> ote
> =A0 DNS poisoning using Java applets. This vulnerability can be triggered w=
> hen
> =A0 opening a malicious webpage. A successful exploitation of this vulnerab=
> ility
> =A0 may lead to disclosure and manipulation of cookies and web pages, discl=
> osure
> =A0 of NTLM credentials and clipboard data of the logged-on user, and even
> =A0 firewall bypass.
> 
> =A0 cache poisoning of arbitrary domains. This vulnerability can be trigger=
> ed
> =A0 by a normal user (i.e. one with non-administrative rights) in order to
> =A0 attack other users of the system. A successful exploitation of this
> =A0 vulnerability may lead to information disclosure, privilege escalation,
> =A0 universal XSS and more.
> 
> =A0Whitepaper: http://bit.ly/q31wSq
> =A0A blog post with video demos: http://bit.ly/qu4Ez7
> 
> 
> Roee Hay <[email-masked]>, IBM Rational Application Security Research Gro=
> up
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Masataka Ohta <[email-masked]>
Date: Mon, 24 Oct 2011 18:39:33 +0900

Paul Wouters;

I think the following ID solves the problem.

	http://www.ietf.org/id/draft-ohta-practically-secure-dns-00.txt

							Masataka Ohta