Python-dns does not randomize TID causing DNS poisoning risk

[Scott Kitterman]

Binary package hint: python-dns

Ideally one wants to randomize port and TID. Python-dns opens a new socket for each request, so the OS should handle socket randomization. Dapper does not. Hardy does. Do not know about Feisty/Gutsy. Python-dns does not randomize TID. Upstream will release a new version that support that to resolve their part of the problem.

[Scott Kitterman (kitterman)]

2.6.24 provides port randomization, so it not affected. Once I get a TID randomizing python-dns for Hardy/Intrepid, those releases will have mitigation in place. Still need to check for port randomizatioin in Feisty/Gutsy.

[Scott Kitterman (kitterman)]

python-dns_2.3.1-4 just uploaded to Debian and Intrepid partially addressed this problem. TID is randomized when queries are created, but not when they are retried. Change from upstream CVS repository.

[Scott Kitterman (kitterman)]

Confirmed on Gutsy (if I'm reading the tcpdump output correctly):

15:08:07.642049 IP vood.lan.domain > sebner-desktop.local.32772: 0 5/7/3 CNAME www.l.google.com.,[|domain]
15:08:07.646050 IP 192.168.128.2.domain > sebner-desktop.local.32773: 30850- 1/0/0 PTR[|domain]
15:08:08.262120 IP sebner-desktop.local.32773 > vood.lan.domain: 0+ A? www.google.com. (32)
15:08:08.270121 IP vood.lan.domain > sebner-desktop.local.32773: 0 5/7/3 CNAME www.l.google.com.,[|domain]
15:08:08.690169 IP sebner-desktop.local.32773 > vood.lan.domain: 0+ A? www.google.com. (32)
15:08:08.690169 IP vood.lan.domain > sebner-desktop.local.32773: 0 5/7/3 CNAME www.l.google.com.,[|domain]
15:08:09.082213 IP sebner-desktop.local.32773 > vood.lan.domain: 0+ A? www.google.com. (32)
15:08:09.082213 IP vood.lan.domain > sebner-desktop.local.32773: 0 5/7/3 CNAME www.l.google.com.,[|domain]
15:08:09.526264 IP sebner-desktop.local.32773 > vood.lan.domain: 0+ A? www.google.com. (32)
15:08:09.534265 IP vood.lan.domain > sebner-desktop.local.32773: 0 5/7/3 CNAME www.l.google.com.,[|domain]

[Scott Kitterman (kitterman)]

That should do it....

Upstream reviewed a previous version of this patch (some of it comes from their CVS repository, but they only did TID randomization, not source port randomization). This version addresses their comment, but I haven't heard back from them on it.

I tested this on Dapper (which has a kernel that does not randomize ports) and captured DNS data using ethereal and observed that the source port and TID changed in an apparently random fashion each time.

[Kees Cook (kees)]

Nice, I'm getting them uploaded now.

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-dns - 2.3.1-2ubuntu0.1

---------------
python-dns (2.3.1-2ubuntu0.1) hardy-security; urgency=high

  * SECURITY UPDATE: Add source port and TID randomization (LP: #247409)
  * References
  * CVE-2008-1447 DNS source port guessable

 -- Scott Kitterman <email address hidden> Sat, 26 Jul 2008 01:46:54 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-dns - 2.3.1-1ubuntu0.1

---------------
python-dns (2.3.1-1ubuntu0.1) gutsy-security; urgency=high

  * SECURITY UPDATE: Add source port and TID randomization (LP: #247409)
  * References
  * CVE-2008-1447 DNS source port guessable

 -- Scott Kitterman <email address hidden> Sat, 26 Jul 2008 02:08:46 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-dns - 2.3.0-5.1ubuntu2.1

---------------
python-dns (2.3.0-5.1ubuntu2.1) feisty-security; urgency=high

  * SECURITY UPDATE: Add source port and TID randomization (LP: #247409)
  * References
  * CVE-2008-1447 DNS source port guessable

 -- Scott Kitterman <email address hidden> Sat, 26 Jul 2008 02:17:03 -0400

[LumpyCustard (orangelumpycustard)]

Please could someone mark this as Won't Fix for Feisty?

[Leann Ogasawara (leannogasawara)]

Also closing the Gutsy nomination since it's reached it's end of life - http://www.ubuntu.com/news/ubuntu-7.10-eol