Microsoft Windows DNS spoofing information disclosure (DNS_Cache_Poison)

About this signature or vulnerability

Proventia Server IPS for Microsoft Windows technology, BlackICE PC Protection, BlackICE Server Protection, Proventia Network MFS, Proventia-G 1.1 and earlier, Proventia Network IDS, Proventia Desktop, Proventia Network IPS, RealSecure Server Sensor, RealSecure Network, Proventia Server IPS for Linux technology:

This signature detects a DNS cache poisoning attack where an attacker sends many DNS responses trying to guess the correct transaction ID for an outstanding query. If the attacker guesses correctly, he can poison the DNS cache of the receiving server. After this signature detects an attack, all future packets associated with the attack will be dropped (this only applies to sensors operating in inline mode). The automatic drop response will occur when the signature is enabled, REGARDLESS of the blocking configuration of the signature.

This signature detects a DNS cache poisoning attack where an attacker sends many DNS responses trying to guess the correct transaction ID for an outstanding query. If the attacker guesses correctly, he can poison the DNS cache of the receiving server. After this signature detects an attack, all future packets associated with the attack will be dropped (this only applies to sensors operating in inline mode). The automatic drop response can be disabled by setting the tuning parameter 'pam.dns_cache_poison.drop' to 'false'.

Proventia Server IPS for Microsoft Windows technology, BlackICE PC Protection, BlackICE Server Protection, Proventia Network MFS, Proventia-G 1.1 and earlier, Proventia Network IDS, Proventia Desktop, Proventia Network IPS, RealSecure Server Sensor, RealSecure Network, Proventia Server IPS for Linux technology: A false positive is possible if a single DNS query receives a very large number of legitimate answers. Multiple legitimate answers occur when a DNS query is fanned out upstream, but this activity normally does not rise to the level necessary to trigger this signature. If false positives are known to occur, change the parameter pam.dns_cache_poison.answer.limit to a higher value.

False negatives

Proventia Server IPS for Microsoft Windows technology, BlackICE PC Protection, BlackICE Server Protection, Proventia Network MFS, Proventia-G 1.1 and earlier, Proventia Network IDS, Proventia Desktop, Proventia Network IPS, RealSecure Server Sensor, RealSecure Network, Proventia Server IPS for Linux technology: A false negative is possible if the attacker guesses the correct DNS transaction ID of a specific question with very few attempts.

Default risk level

 Medium

Sensors that have this signature

Proventia Server IPS for Microsoft Windows technology: 1.0.914.2120, BlackICE PC Protection: 3.6cqr, BlackICE Server Protection: 3.6.cqr, Proventia Network MFS: XPU 27.110, Proventia-G 1.1 and earlier: XPU 27.110, Proventia Network IDS: XPU 27.110, Proventia Desktop: 2120, Proventia Network IPS: XPU 27.110, RealSecure Server Sensor: XPU 27.110, RealSecure Network: XPU 27.110, Proventia Server IPS for Linux technology: 27.110

Systems affected

Microsoft Windows 2000: SP4, Microsoft Windows 2003 Server: x64, Microsoft Windows 2003 Server: SP1, Microsoft Windows 2003 Server: SP1 Itanium, Microsoft Windows 2003 Server: SP2, Microsoft Windows 2003 Server: SP2 Itanium, Microsoft Windows 2003 Server: SP2 x64, HP Storage Management Appliance: 2.1

Type

Protocol Signature

Vulnerability description

How to remove this vulnerability

References