Major bug in one of the Internet's core building blocks

http://arstechnica.com/security/2016/02/extremely-se...

This is moot. Sure, it's a big deal on the surface, but if you use your ISP DNS (as all should) then no big deal. Just don't let your devices connect to arbitrary DNS servers - and in what context would that happen anyway?

The only other issue is if your DNS server (ISP or HOME) gets hi-jacked to point to the ones that will do this (unlikely).

Sleep tight tonight.

Nick

The bug has been around since 2008 and not been exploited yet so fair to say its not easy to do

Nobody had seen it before, that doesn't mean it's hard to do.

True, but there are people out there that actively look for exploits like this, yet it appears it was discovered by accident.

In reply to a post by Lethe:

This is moot. Sure, it's a big deal on the surface, but if you use your ISP DNS (as all should) then no big deal. Just don't let your devices connect to arbitrary DNS servers - and in what context would that happen anyway?

The only other issue is if your DNS server (ISP or HOME) gets hi-jacked to point to the ones that will do this (unlikely).

Sleep tight tonight.

Nick

I think that's an over simplistic view of the issue. There are vast numbers of scripts that have been compiled using GlibC or make calls to GlibC functionality. Sure it's a DNS related issue but lots of scripts rely on DNS functionality and if one of those scripts causes the overflow you're vulnerable to an exploitation. Just think about all those old routers out there that people have never patched or unsupported end of life products with no updates available. Anyone running a public facing server needs to take some sort of proactive measures to mitigate the chances of a successful attack. Updating GlibC with the new patch isn't going to be enough if running scripts were complied with the old version leaving them vulnerable.

You miss the point. My machine queries the DNS I set (usually my ISP). That then queries up the tier.

How can a hosted DNS malware server that my network doesn't touch can touch me?

The only way I read into this is if you use a compromised DNS server that is using this flaw you will get done - and also the man-in-the-middle attack is so complex, it is totally unlikely in a million years you will get hurt.

It's just moot.

Nick