Leading vendors team up to squash DNS bug

Leading vendors have teamed up to release a patch to fix a serious bug that has affected the DNS protocol that underlies the entire Internet. Microsoft, Cisco, Red Hat, Sun Microsystems and the Internet Software Consortium, makers of the most widely used DNS server software, have all updated their software to address the vulnerability

The bug was discovered some months ago by Dan Kaminsky, a researcher with security vendor IOActive, and since then he and the leading vendors have been working to address the problem.

By sending certain types of queries to DNS servers, the attacker could then redirect victims away from a legitimate website to a malicious website without the victim realising it. This type of attack, known as DNS cache poisoning, doesn't affect only the Web. It could be used to redirect all Internet traffic to the hacker's servers.

The bug could be exploited "like a phishing attack without sending you e-mail," said Wolfgang Kandek, chief technical officer with security company Qualys.

Although this flaw does affect some home routers and client DNS software, it is mostly an issue for corporate users and ISPs that run the DNS servers used by PCs to find their way around the Internet, Kaminsky said. "Home users should not panic," he said.