New DNSSEC Exploit Revealed, Should You Be Worried?

Its severity is rated "low," but patches are out for the second flaw in DNSSEC to be discovered in three months. DNS experts say some exploits are to be expected as the transition continues.

DNS Security Extensions is supposed to be the technology that helps to secure the Domain Name System, or DNS , against attack. Yet DNSSEC servers aren't always infallible, as a pair of vulnerabilities proved this week.

While it's critical to the operation of the Internet as a whole, DNS came under intense scrutiny in 2008 after security researcher Dan Kaminsky disclosed that it was at risk from a widespread vulnerability. Developing a long-term solution to DNS security problems is what the creation of DNSSEC is all about.

Yet, this week, researchers identified DNSSEC itself as being at risk from a cache-poisoning attack.

Specifically, the widely deployed BIND DNS server's DNSSEC implementation was identified as being at risk from a DNSSEC-validation vulnerability. The ISC (Internet Systems Consortium), which is the lead group behind the development of BIND, has now issued patches for the affected BIND servers.

Read "DNSSEC Compromised Again?" at eSecurity Planet