[dnsext] A security concern regarding IPv6 support in name servers

[Alfred Hönes <[e-mail]>]

I have been pointed to a paper by H. D. Moore published in 2008,
"Exploiting Tomorrow's Internet Today - Penetration Testing with IPv6",
available at <http://uninformed.org/?v=10&a=3&t=pdf>.

On page 3, this paper points out that Bind running on an IPv6-enabled
system, unless its serving socket is bound to a specific IPv6 (unicast,
interface-assigned) address of the system, also listens to multicast
traffic (the memo apparently confuses the terms "broadcast" and
"multicast") and will also respond to DNS queries received over IPv6
multicast (e.g., to FF01::1).  This could be leveraged for discovering
nodes and for various amplification / DoS attacks.

So there's the question:  Is this considered a feature or a bug?
Is this still current behavior in the latest versions of Bind?
Do other DNS server implementations expose the same behavior?


Note that IP packets MUST NOT be sent with a source address that is
a multicast address (or the limited broadcast address in the case
of IPv4); therefore, a resolver that actually sent such multicast
query would likely recieve a response to such query that uses a
unicast address of the system running the DNS server as its source
address, and such response would be rejected _if_ the resolver
follows Section 9.1 of RFC 5452.  And based on the same rules, such
response would be rejected as well if the resolver did not send the
query (the source addr of the query had been spoofed by an attacker),
and the response hence does not match an outstanding query.

Although the RFC 5452 checks reduce the possible resulting damage,
in the standard DNS protocol (using server port 53), preferably
such responses should not be sent at all in the first place.


Kind regards,
  Alfred Hönes.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: [phone], Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [e-mail]                     |
+------------------------+--------------------------------------------+