Incidentally, theReformed was running a poll on Dan’s find posted the other day, so far Dan seems to be coming out on top with the people http://thereformed.org/2008/07/19/poll-dan-kaminskys-dns-poisoning-bug/ .

@Dan Kaminsky
How does this not effect DJBDNS? I know DJB has campaigned for years against BIND’s flawed existence, why hasn’t his product received wider adoption?

I’ve been waiting for someone to respond in an official capacity to the question you and Tom Cross raised.

I guess this is the closest thing so far:
http://www.circleid.com/posts/87143_dns_not_a_guessing_game/

” I’m writing this blog post in order to draw more attention to that observation, as I’m not sure that the security industry has realized its full implications. As far as we know, this observation applies to any NAT device, not just the firewall imipack tested, and we think it has significant implications for network architecture.

When a host on a computer network selects a source port for a UDP request, it selects a port that is unique for that host. When a one-to-many hiding NAT device receives that request and translates it, it has to assign a new source port, because the NAT device has to assign unique ports for all of the hosts on the internal network. X-Force is not aware of any NAT device on the market that randomly selects UDP source ports. Therefore, when patched DNS clients and servers are used behind NAT, they are still vulnerable to attack. The source port entropy introduced by the recent patches is cancelled out by the NAT device.

It is our opinion that network administrators who have caching internal DNS servers behind NAT should plan to move those servers into a DMZ where they can be directly assigned a unique Internet IP address. Any servers that remain behind NAT devices will remain vulnerable after patches have been applied, and X-Force suspects that given the amount of media attention DNS Cache Poisoning has received this week that an increased frequency of attack is likely in the coming months.”

What say thee to that? Patching may not be enough if you physically have to move DNS servers to what amounts to DMZ’s and then expose them with 1-to-1 NAT’s instead of hides…oh the fun.

/Hoff

Ah, so I’m not going crazy then. Thought that looked suspect.

There’s a bug in the code. Note that’s not very random.