The remote BIG-IP device is missing a patch required by a security advisory.

The remote host is affected by the vulnerability described in GLSA-200807-08 (BIND: Cache poisoning)

    Dan Kaminsky of IOActive has reported a weakness in the DNS protocol     related to insufficient randomness of DNS transaction IDs and query     source ports.
  Impact :

    An attacker could exploit this weakness to poison the cache of a     recursive resolver and thus spoof DNS traffic, which could e.g. lead to     the redirection of web or mail traffic to malicious sites.
  Workaround :

    There is no known workaround at this time.

The official ruby site reports :

resolv.rb allow remote attackers to spoof DNS answers. This risk can be reduced by randomness of DNS transaction IDs and source ports.

SunOS 5.8: libresolv.so.2, in.named and BI.
Date this patch was last updated by Sun : Mar/09/09

SunOS 5.9: in.dhcpd libresolv and BIND9 pa.
Date this patch was last updated by Sun : Jul/21/11

Update to new upstream release fixing multiple security issues detailed in the upstream advisories:
http://www.ruby-lang.org/en/news/2008/08/08/multiple- vulnerabilities-in-ruby/ - CVE-2008-3655 - multiple insufficient safe mode restrictions - CVE-2008-3656 - WEBrick DoS vulnerability (CPU consumption) - CVE-2008-3657 - missing 'taintness' checks in dl module
- CVE-2008-3905 - resolv.rb adds random transactions ids and source ports to prevent DNS spoofing attacks http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in- rexml/ - CVE-2008-3790 - DoS in the REXML module One issue not covered by any upstream advisory: - CVE-2008-3443 - DoS in the regular expression engine

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Akira Tagoh discovered a vulnerability in Ruby which lead to an integer overflow. If a user or automated system were tricked into running a malicious script, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-2376)

Laurent Gaffie discovered that Ruby did not properly check for memory allocation failures. If a user or automated system were tricked into running a malicious script, an attacker could cause a denial of service. (CVE-2008-3443)

Keita Yamaguchi discovered several safe level vulnerabilities in Ruby.
An attacker could use this to bypass intended access restrictions.
(CVE-2008-3655)

Keita Yamaguchi discovered that WEBrick in Ruby did not properly validate paths ending with '.'. A remote attacker could send a crafted HTTP request and cause a denial of service. (CVE-2008-3656)

Keita Yamaguchi discovered that the dl module in Ruby did not check the taintness of inputs. An attacker could exploit this vulnerability to bypass safe levels and execute dangerous functions. (CVE-2008-3657)

Luka Treiber and Mitja Kolsek discovered that REXML in Ruby did not always use expansion limits when processing XML documents. If a user or automated system were tricked into open a crafted XML file, an attacker could cause a denial of service via CPU consumption.
(CVE-2008-3790)

Jan Lieskovsky discovered several flaws in the name resolver of Ruby.
A remote attacker could exploit this to spoof DNS entries, which could lead to misdirected traffic. This is a different vulnerability from CVE-2008-1447. (CVE-2008-3905).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Flaws in the remote DNS library may let an attacker send malicious DNS responses to DNS requests made by the remote host, thereby spoofing or redirecting internet traffic from legitimate locations.

Dan Kaminsky discovered that properties inherent to the DNS protocol lead to practical DNS cache poisoning attacks. Among other things, successful attacks can lead to misdirected web traffic and email rerouting.

This update changes Debian's BIND 9 packages to implement the recommended countermeasure: UDP query source port randomization. This change increases the size of the space from which an attacker has to guess values in a backwards-compatible fashion and makes successful attacks significantly more difficult.

Note that this security update changes BIND network behavior in a fundamental way, and the following steps are recommended to ensure a smooth upgrade.

1. Make sure that your network configuration is compatible with source port randomization. If you guard your resolver with a stateless packet filter, you may need to make sure that no non-DNS services listen on the 1024--65535 UDP port range and open it at the packet filter. For instance, packet filters based on etch's Linux 2.6.18 kernel only support stateless filtering of IPv6 packets, and therefore pose this additional difficulty. (If you use IPv4 with iptables and ESTABLISHED rules, networking changes are likely not required.)

2. Install the BIND 9 upgrade, using 'apt-get update' followed by 'apt-get install bind9'. Verify that the named process has been restarted and answers recursive queries. (If all queries result in timeouts, this indicates that networking changes are necessary; see the first step.)

3. Verify that source port randomization is active. Check that the /var/log/daemon.log file does not contain messages of the following form

named[6106]: /etc/bind/named.conf.options:28: using specific query-source port suppresses port randomization and can be insecure.

right after the 'listening on IPv6 interface' and 'listening on IPv4 interface' messages logged by BIND upon startup. If these messages are present, you should remove the indicated lines from the configuration, or replace the port numbers contained within them with '*' sign (e.g., replace 'port 53' with 'port *').

For additional certainty, use tcpdump or some other network monitoring tool to check for varying UDP source ports. If there is a NAT device in front of your resolver, make sure that it does not defeat the effect of source port randomization.

4. If you cannot activate source port randomization, consider configuring BIND 9 to forward queries to a resolver which can, possibly over a VPN such as OpenVPN to create the necessary trusted network link. (Use BIND's forward-only mode in this case.)

Other caching resolvers distributed by Debian (PowerDNS, MaraDNS, Unbound) already employ source port randomization, and no updated packages are needed. BIND 9.5 up to and including version 1:9.5.0.dfsg-4 only implements a weak form of source port randomization and needs to be updated as well. For information on BIND 8, see DSA-1604-1, and for the status of the libc stub resolver, see DSA-1605-1.

The updated bind9 packages contain changes originally scheduled for the next stable point release, including the changed IP address of L.ROOT-SERVERS.NET (Debian bug # 449148).

Multiple weaknesses have been identified in PyDNS, a DNS client implementation for the Python language. Dan Kaminsky identified a practical vector of DNS response spoofing and cache poisoning, exploiting the limited entropy in a DNS transaction ID and lack of UDP source port randomization in many DNS implementations. Scott Kitterman noted that python-dns is vulnerable to this predictability, as it randomizes neither its transaction ID nor its source port. Taken together, this lack of entropy leaves applications using python-dns to perform DNS queries highly susceptible to response forgery.

The Common Vulnerabilities and Exposures project identifies this class of weakness as CVE-2008-1447 and this specific instance in PyDNS as CVE-2008-4099.

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXBA:2008-315:02 advisory.

  - The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2)     Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations     allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to     conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction     IDs and source ports, aka DNS Insufficient Socket Entropy Vulnerability or the Kaminsky bug.
    (CVE-2008-1447)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update of dnsmasq uses random UDP source ports and a random TRXID now. (CVE-2008-1447)

ID	Name	Product	Family	Published	Updated	Severity
78224	F5 Networks BIG-IP : BIND DNS cache poisoning vulnerability (SOL8938)	Nessus	F5 Networks Local Security Checks	10/10/2014	1/11/2021	medium
33494	GLSA-200807-08 : BIND: Cache poisoning	Nessus	Gentoo Local Security Checks	7/15/2008	1/6/2021	medium
33905	FreeBSD : ruby -- DNS spoofing vulnerability (959d384d-6b59-11dd-9d79-001fc61c2a55)	Nessus	FreeBSD Local Security Checks	8/17/2008	1/6/2021	medium
13321	Solaris 8 (sparc) : 109326-24	Nessus	Solaris Local Security Checks	7/12/2004	1/14/2021	critical
26165	Solaris 9 (sparc) : 112837-24	Nessus	Solaris Local Security Checks	9/25/2007	1/14/2021	medium
34380	Fedora 9 : ruby-1.8.6.287-2.fc9 (2008-8738)	Nessus	Fedora Local Security Checks	10/10/2008	1/11/2021	high
37068	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : ruby1.8 vulnerabilities (USN-651-1)	Nessus	Ubuntu Local Security Checks	4/23/2009	1/19/2021	high
33441	MS08-037: Vulnerabilities in DNS Could Allow Spoofing (953230)	Nessus	Windows : Microsoft Bulletins	7/8/2008	11/15/2018	medium
33450	Debian DSA-1603-1 : bind9 - DNS cache poisoning	Nessus	Debian Local Security Checks	7/10/2008	1/4/2021	medium
33739	Debian DSA-1619-1 : python-dns - DNS response spoofing	Nessus	Debian Local Security Checks	7/28/2008	1/4/2021	medium
291441	MiracleLinux 3 : dnsmasq-2.45-1AXS3.1.1 (AXBA:2008-315:02)	Nessus	Miracle Linux Local Security Checks	1/19/2026	1/19/2026	medium
39951	openSUSE Security Update : dnsmasq (dnsmasq-147)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

critical

medium

high

high

medium

medium

medium

medium

medium