Problem Description:
The BIND DNS implementation does not randomize the UDP source
port when doing remote queries, and the query id alone does
not provide adequate randomization.
Impact:
The lack of source port randomization reduces the amount of
data the attacker needs to guess in order to successfully
execute a DNS cache poisoning attack. This allows the
attacker to influence or control the results of DNS queries
being returned to users from target systems.
Workaround:
Limiting the group of machines that can do recursive queries
on the DNS server will make it more difficult, but not
impossible, for this vulnerability to be exploited.
To limit the machines able to perform recursive queries, add an ACL in
named.conf and limit recursion like the following:
acl example-acl {
192.0.2.0/24;
};
options {
recursion yes;
allow-recursion { example-acl; };
};