<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
I actually wrote the blog post and tried to be very specific in what I wrote. The claim was that we could protect from the malformed DNS packets put forward in the PoC code. Which is accurate and the best information we had to go on at the time. Further
updates have come out now that say the vulnerability is exploitable with properly constructed DNS packets. That’s a whole different ball game (as discussed in this thread and many others like it.)
<div class=""><br class="">
</div>
<div class="">I’ll see what can be done to put a disclaimer on that article that new information means that we may not offer the protection once thought. (For me this is also an issue with the disclosure, we want to protect people from being exploited obviously,
but the initial posting didn’t give a ton of information on what an actual attack could/would look like. A couple people at OpenDNS reached out to contacts at RedHat and were unable to get any additional information aside from what was in the Google article.)</div>
<div class=""><br class="">
</div>
<div class="">Anyway...</div>
<div class=""><br class="">
</div>
<div class="">— Brian</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<div class="">
<div>
<blockquote type="cite" class="">
<div class="">On Feb 23, 2016, at 11:20 AM, Damian Menscher <<a href="mailto:damian@google.com" class="">damian@google.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">
<div class="gmail_extra">
<div class="gmail_quote">On Tue, Feb 23, 2016 at 10:01 AM, Mike Hoskins (michoski)
<span dir="ltr" class=""><<a href="mailto:michoski@cisco.com" target="_blank" class="">michoski@cisco.com</a>></span> wrote:<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div id=":4mn" class="a3s" style="overflow:hidden">Just in case anyone's wondering, OpenDNS isn't affected.<br class="">
<br class="">
<a href="https://engineering.opendns.com/2016/02/17/2980/" rel="noreferrer" target="_blank" class="">https://engineering.opendns.com/2016/02/17/2980/</a></div>
</blockquote>
</div>
<br class="">
They're not directly vulnerable, but their claim that they protect their users is a bit over-stated -- all RFC-compliant DNS servers provide the same protections (not forwarding packets that don't follow the DNS spec). The problem is that there *might* be
a way to exploit this via RFC-compliant DNS packets (I'm personally not convinced, but nobody wants to claim it's impossible). And that would get past their defenses (and everyone else's).</div>
<div class="gmail_extra"><br class="">
</div>
<div class="gmail_extra">Additionally, anyone using a remote resolver is vulnerable to a MitM injecting a malicious response, so everyone should upgrade. Claims that OpenDNS users "aren't affected" are misleading and dangerous.</div>
<div class="gmail_extra"><br class="">
</div>
<div class="gmail_extra">Damian</div>
</div>
_______________________________________________<br class="">
dns-operations mailing list<br class="">
<a href="mailto:dns-operations@lists.dns-oarc.net" class="">dns-operations@lists.dns-oarc.net</a><br class="">
https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br class="">
dns-jobs mailing list<br class="">
https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</body>
</html>