Exploit emerges for DNS flaw

Researchers HD Moore and Druid have developed a module which is capable of exploiting the vulnerability. The module runs through Metasploit, a vulnerability-testing framework built by Moore.

The exploit code is the first to appear for the DNS cache-poisoning flaw first discovered by researcher Dan Kaminsky.

The release of the module comes just days after details of the flaw were disclosed by fellow researcher Halvar Flake.

Kaminsky said that he had found the flaw, but refrained from disclosing the details until vendors could issue a patch. He planned to unveil the details at next month's Blackhat conference.

Though the details of the vulnerability were not publically available, Kaminsky shared his research with a number of hardware and software vendors, prompting one of the largest mass-patch rollouts in history.

That policy may have helped avoid a major catastrophe, as most servers were protected even before details on the flaw were publically known.

Zulfikar Ramzan, technical director of Symantec's Security Technology and Response (STAR) team, told vnunet.com that the exploit code ads little danger to the situation at this point.

"My impression is that most of the major ISPs have already patched," said Ramzan.

"At this stage I don't know if it is going to affect end users."

Ramzan said that while there are a large number of server that have not been patched, many are poorly maintained servers and are likely to be open to older, more established attack methods anyways.

He also noted that though the module has the ability to exploit the flaw, it is far from a real-world attack by actual criminals.

However, administrators may not be out of the woods just yet. Ramzan said that a greater danger could come after Kaminsky posts the full details of the flaw and attackers get a better look at the nature of the vulnerability.

"There is a saying in the security community that attacks always get better, they never get worse," he explained.

"Someone might develop variations on the attack that are more potent in the future."

Copyright ©v3.co.uk

dnsemergesexploitflawforsecurity