漏洞描述
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka "DNS Insufficient Socket Entropy Vulnerability" or "the Kaminsky bug."
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.vupen.comhttp://www.vupen.com/english/advisories/2008/2466↗secunia.comhttp://secunia.com/advisories/31094↗lists.apple.comhttp://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html↗secunia.comhttp://secunia.com/advisories/31011↗www.ibm.comhttp://www.ibm.com/support/docview.wss?uid=isg1IZ26669↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2092/references↗www.phys.uu.nlhttp://www.phys.uu.nl/~rombouts/pdnsd.html↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2582↗www.vupen.comhttp://www.vupen.com/english/advisories/2010/0622↗slackware.comhttp://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.539239↗www.ibm.comhttp://www.ibm.com/support/docview.wss?uid=isg1IZ26670↗docs.microsoft.comhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-037↗www.openbsd.orghttp://www.openbsd.org/errata42.html#013_bind↗oval.cisecurity.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9627↗secunia.comhttp://secunia.com/advisories/30925↗secunia.comhttp://secunia.com/advisories/31137↗www.ipcop.orghttp://www.ipcop.org/index.php?name=News&file=article&sid=40↗www.securitytracker.comhttp://www.securitytracker.com/id?1020804↗www.securitytracker.comhttp://www.securitytracker.com/id?1020802↗www.vmware.comhttp://www.vmware.com/security/advisories/VMSA-2008-0014.html↗www.nominum.comhttp://www.nominum.com/asset_upload_file741_2661.pdf↗secunia.comhttp://secunia.com/advisories/30988↗secunia.comhttp://secunia.com/advisories/31152↗security.gentoo.orghttp://security.gentoo.org/glsa/glsa-201209-25.xml↗www.kb.cert.orghttp://www.kb.cert.org/vuls/id/800113↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2558↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2051/references↗secunia.comhttp://secunia.com/advisories/31065↗www.ibm.comhttp://www.ibm.com/support/docview.wss?uid=isg1IZ26671↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2030/references↗www.redhat.comhttps://www.redhat.com/archives/fedora-package-announce/2008-July/msg00402.html↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2113/references↗secunia.comhttp://secunia.com/advisories/31052↗secunia.comhttp://secunia.com/advisories/30977↗h20000.www2.hp.comhttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01662368↗oval.cisecurity.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5917↗www.securitytracker.comhttp://www.securitytracker.com/id?1020448↗secunia.comhttp://secunia.com/advisories/30979↗secunia.comhttp://secunia.com/advisories/31030↗secunia.comhttp://secunia.com/advisories/31236↗support.citrix.comhttp://support.citrix.com/article/CTX118183↗www.debian.orghttp://www.debian.org/security/2008/dsa-1604↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2025/references↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2291↗marc.infohttp://marc.info/?l=bugtraq&m=141879471518471&w=2↗secunia.comhttp://secunia.com/advisories/31012↗marc.infohttp://marc.info/?l=bugtraq&m=123324863916385&w=2↗www.novell.comhttp://www.novell.com/support/viewContent.do?externalId=7000912↗www.vupen.comhttp://www.vupen.com/english/advisories/2009/0297↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2467↗secunia.comhttp://secunia.com/advisories/31022↗exchange.xforce.ibmcloud.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/43334↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2052/references↗www.mandriva.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:139↗secunia.comhttp://secunia.com/advisories/31031↗security.freebsd.orghttp://security.freebsd.org/advisories/FreeBSD-SA-08:06.bind.asc↗www.isc.orghttp://www.isc.org/index.pl?/sw/bind/bind-security.php↗secunia.comhttp://secunia.com/advisories/31143↗secunia.comhttp://secunia.com/advisories/31237↗exchange.xforce.ibmcloud.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/43637↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2334↗secunia.comhttp://secunia.com/advisories/31326↗www.ruby-lang.orghttp://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/↗up2date.astaro.comhttp://up2date.astaro.com/2008/08/up2date_7202_released.html↗secunia.comhttp://secunia.com/advisories/31221↗www.bluecoat.comhttp://www.bluecoat.com/support/security-advisories/dns_cache_poisoning↗www.phys.uu.nlhttp://www.phys.uu.nl/~rombouts/pdnsd/ChangeLog↗bugs.debian.orghttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401↗www.securityfocus.comhttp://www.securityfocus.com/archive/1/495289/100/0/threaded↗secunia.comhttp://secunia.com/advisories/31495↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2549↗oval.cisecurity.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5725↗secunia.comhttp://secunia.com/advisories/30973↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2525↗secunia.comhttp://secunia.com/advisories/30998↗secunia.comhttp://secunia.com/advisories/33786↗www.debian.orghttp://www.debian.org/security/2008/dsa-1623↗www.securitytracker.comhttp://www.securitytracker.com/id?1020560↗www.redhat.comhttps://www.redhat.com/archives/fedora-package-announce/2008-July/msg00458.html↗secunia.comhttp://secunia.com/advisories/31014↗www.securitytracker.comhttp://www.securitytracker.com/id?1020437↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2383↗www.securitytracker.comhttp://www.securitytracker.com/id?1020558↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2023/references↗support.apple.comhttp://support.apple.com/kb/HT3129↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2139/references↗www.kb.cert.orghttp://www.kb.cert.org/vuls/id/MIMG-7DWR4J↗lists.grok.org.ukhttp://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2196/references↗www.securitytracker.comhttp://www.securitytracker.com/id?1020575↗secunia.comhttp://secunia.com/advisories/31153↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2114/references↗www.vupen.comhttp://www.vupen.com/english/advisories/2009/0311↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2008-0533.html↗www.securitytracker.comhttp://www.securitytracker.com/id?1020440↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2055/references↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2195/references↗secunia.comhttp://secunia.com/advisories/31019↗www.rtpro.yamaha.co.jphttp://www.rtpro.yamaha.co.jp/RT/FAQ/Security/VU800113.html↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2268↗secunia.comhttp://secunia.com/advisories/31482↗lists.apple.comhttp://lists.apple.com/archives/security-announce//2008/Sep/msg00004.html↗wiki.rpath.comhttp://wiki.rpath.com/wiki/Advisories:rPSA-2010-0018↗marc.infohttp://marc.info/?l=bugtraq&m=121866517322103&w=2↗sunsolve.sun.comhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-240048-1↗www.debian.orghttp://www.debian.org/security/2008/dsa-1603↗www.securitytracker.comhttp://www.securitytracker.com/id?1020577↗www.us-cert.govhttp://www.us-cert.gov/cas/techalerts/TA08-190A.html↗secunia.comhttp://secunia.com/advisories/31354↗secunia.comhttp://secunia.com/advisories/31151↗secunia.comhttp://secunia.com/advisories/31451↗security.gentoo.orghttp://security.gentoo.org/glsa/glsa-200807-08.xml↗support.nortel.comhttp://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=762152↗marc.infohttp://marc.info/?l=bugtraq&m=121630706004256&w=2↗secunia.comhttp://secunia.com/advisories/33178↗secunia.comhttp://secunia.com/advisories/30989↗www.debian.orghttp://www.debian.org/security/2008/dsa-1619↗secunia.comhttp://secunia.com/advisories/33714↗www.securitytracker.comhttp://www.securitytracker.com/id?1020449↗secunia.comhttp://secunia.com/advisories/31422↗www.ibm.comhttp://www.ibm.com/support/docview.wss?uid=isg1IZ26667↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2019/references↗secunia.comhttp://secunia.com/advisories/31430↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2197/references↗slackware.comhttp://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.452680↗www.cisco.comhttp://www.cisco.com/en/US/products/products_security_advisory09186a00809c2168.shtml↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2123/references↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2166/references↗security.gentoo.orghttp://security.gentoo.org/glsa/glsa-200812-17.xml↗www.securityfocus.comhttp://www.securityfocus.com/bid/30131↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2377↗www.securitytracker.comhttp://www.securitytracker.com/id?1020578↗wiki.rpath.comhttp://wiki.rpath.com/wiki/Advisories:rPSA-2008-0231↗secunia.comhttp://secunia.com/advisories/31882↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2482↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2384↗secunia.comhttp://secunia.com/advisories/30980↗lists.apple.comhttp://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html↗secunia.comhttp://secunia.com/advisories/31072↗www.openbsd.orghttp://www.openbsd.org/errata43.html#004_bind↗secunia.comhttp://secunia.com/advisories/31204↗oval.cisecurity.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12117↗secunia.comhttp://secunia.com/advisories/31254↗blog.invisibledenizen.orghttp://blog.invisibledenizen.org/2008/07/kaminskys-dns-issue-accidentally-leaked.html↗secunia.comhttp://secunia.com/advisories/31033↗sunsolve.sun.comhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-239392-1↗secunia.comhttp://secunia.com/advisories/31588↗www.doxpara.comhttp://www.doxpara.com/DMK_BO2K8.ppt↗secunia.comhttp://secunia.com/advisories/31687↗www.us-cert.govhttp://www.us-cert.gov/cas/techalerts/TA08-260A.html↗support.citrix.comhttp://support.citrix.com/article/CTX117991↗www.securitytracker.comhttp://www.securitytracker.com/id?1020561↗www.ubuntu.comhttp://www.ubuntu.com/usn/usn-627-1↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2029/references↗www.securitytracker.comhttp://www.securitytracker.com/id?1020702↗www.doxpara.comhttp://www.doxpara.com/?p=1176↗oval.cisecurity.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5761↗support.apple.comhttp://support.apple.com/kb/HT3026↗lists.apple.comhttp://lists.apple.com/archives/security-announce//2008/Sep/msg00003.html↗www.securitytracker.comhttp://www.securitytracker.com/id?1020653↗secunia.comhttp://secunia.com/advisories/31207↗www.redhat.comhttp://www.redhat.com/support/errata/RHSA-2008-0789.html↗www.us-cert.govhttp://www.us-cert.gov/cas/techalerts/TA08-190B.html↗secunia.comhttp://secunia.com/advisories/31169↗www.ibm.comhttp://www.ibm.com/support/docview.wss?uid=isg1IZ26672↗www.unixwiz.nethttp://www.unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html↗secunia.comhttp://secunia.com/advisories/31213↗www.securitytracker.comhttp://www.securitytracker.com/id?1020438↗secunia.comhttp://secunia.com/advisories/31093↗h20000.www2.hp.comhttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01523520↗www.securitytracker.comhttp://www.securitytracker.com/id?1020651↗secunia.comhttp://secunia.com/advisories/31900↗secunia.comhttp://secunia.com/advisories/31209↗secunia.comhttp://secunia.com/advisories/31197↗www.securityfocus.comhttp://www.securityfocus.com/archive/1/495869/100/0/threaded↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2050/references↗secunia.comhttp://secunia.com/advisories/31212↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2008-07/msg00003.html↗secunia.comhttp://secunia.com/advisories/31199↗www.securitytracker.comhttp://www.securitytracker.com/id?1020579↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2342↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html↗www.securitytracker.comhttp://www.securitytracker.com/id?1020576↗www.ibm.comhttp://www.ibm.com/support/docview.wss?uid=isg1IZ26668↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/2584↗www.debian.orghttp://www.debian.org/security/2008/dsa-1605↗secunia.comhttp://secunia.com/advisories/31823↗www.securitytracker.comhttp://www.securitytracker.com/id?1020548↗www.kb.cert.orghttp://www.kb.cert.org/vuls/id/MIMG-7ECL8Q↗www.ubuntu.comhttp://www.ubuntu.com/usn/usn-622-1↗