DNS Patches Slow Servers, but Fast Action Is Advised

Computerworld — Software patches released in early July to protect against a critical flaw in the Domain Name System protocol have slowed servers running the Internet's most popular DNS implementation and crippled some Windows Server systems.

Meanwhile, security researcher HD Moore — who helped craft the first exploit code to be publicly released for the flaw — claimed last week that hackers were actively taking advantage of the cache-poisoning vulnerability using previously unknown exploits.

If Moore is right, that puts even more pressure on companies and ISPs to quickly patch their DNS servers, despite the performance problems disclosed by Microsoft Corp. and Internet Systems Consortium Inc. (ISC). Adding even more fuel to the fire is the fact that Dan Kaminsky, the researcher who discovered the flaw, plans to detail it at this week's Black Hat USA 2008 conference.

In a mailing-list message last Monday, Paul Vixie, the ISC's president, said that systems administrators shouldn't roll back the patches for the group's Berkeley Internet Name Domain software, even if their servers are running more slowly than before. "The vulnerability is of more concern than a slow server," he wrote.

BIND is distributed by vendors such as Novell, Red Hat and Sun Microsystems, all of which have released the updated versions of the ISC's software to their customers and urged IT managers to install the upgrades.

In his message, Vixie said that when ISC developers were building the initial patches, they became aware of a problem that could affect the performance of high-traffic DNS servers. But he added that because of the risks posed by the flaw, "we chose to finish the patches ASAP" and accelerate work on updates designed to fix the problem.

Separate port-allocation issues were found after the patches were released, Vixie said. Those are also supposed to be addressed in the updated patches, which were scheduled to become available late last week.

Microsoft issued a mea culpa about its DNS update on July 17, saying that the patch was crippling some machines running its Windows Small Business Server suite. Then, on July 25, it said the patch could also affect some network services on systems running Windows Server 2008, Windows Server 2003 and Windows 2000. In both instances, Microsoft detailed work-arounds.