gmane.comp.macosx.general

root hints file

>From comp.risks 25.26:

> Date: Tue, 5 Aug 2008 18:49:27 +0100
> From: Robin Stevens <rejs@...>
> Subject: Re: Apple Fails to Patch Critical Exploited DNS Flaw (RISKS-25.25)
> 
> I too was unimpressed by Apple's slow response to Kaminsky's DNS flaw (which
> appears to be inadequate - see <http://db.tidbits.com/article/9721>).
> Unfortunately it's far from the only flaw they've been slow to correct.
> 
> Their latest version of the operating system (OS X 10.5) still ships with a
> root hints file dating from 2002.  This hints file is that used to
> "bootstrap" the whole process of DNS resolution, by listing the IP addresses
> of the thirteen top-level servers.  Unfortunately, since 2002, two of the IP
> addresses have changed.  This isn't generally a problem; if the first
> address tried fails to respond, then a nameserver will simply try another.
> 
> But what if, instead of getting no response from an obsolete root server
> address, a malicious response is received from a third party?  This isn't
> purely scare-mongering.  Hijacking of an old address has already been seen,
> e.g.:
> <http://www.renesys.com/blog/2008/05/identity_theft_hits_the_root_n_1.shtml>
> following the most recent address change.  There's no reason to suspect any
> malicious intent in this case, but it could have happened.
> 
> I reported to Apple in early 2006 that their root hints file was out of
> date.  They responded, telling me they were already aware of this.  OS X
> 10.5 shipped last year, with the same outdated hints file.  It's *still*
> unfixed - why?
>

(Continue reading)

headers

Michael Nickerson | 21 Aug 10:59

Re: root hints file

On Aug 7, 2008, at 10:34 AM, William Ehrich wrote:

>> From comp.risks 25.26:
>
>> Date: Tue, 5 Aug 2008 18:49:27 +0100
>> From: Robin Stevens <rejs@...>
>>
>>
>> I reported to Apple in early 2006 that their root hints file was  
>> out of
>> date.  They responded, telling me they were already aware of this.   
>> OS X
>> 10.5 shipped last year, with the same outdated hints file.  It's  
>> *still*
>> unfixed - why?
>> Robin Stevens  <rejs@...> http://www.cynic.org.uk/
>
> Is this something we should worry about? fix?
>

Not necessarily. The named server only runs on (client) OS X machines  
if you've turned Internet Sharing on in the Sharing preference panel,  
so if you're not sharing your connection then the root hints file  
being out of date doesn't matter at all.

As for the fix, it's fairly simple.  In the Terminal, go to /var/named  
and type:

sudo dig @m.root-servers.net. NS > named.ca

(Continue reading)

headers

Christopher Bort | 21 Aug 19:42

Re: root hints file

On 08/21/08 01:59, poetman13@... (Michael Nickerson) wrote:

>The named server only runs on (client) OS X machines if you've turned
>Internet Sharing on in the Sharing preference panel

Or if you've enabled the org.isc.named launch daemon (Tiger, 
Leopard), or set DNSSERVER=-YES- in /etc/hostconfig (Panther and 
earlier), or otherwise explicitly started named. It doesn't run 
by default, but there's more than one way to have it running.

--

-- 
Christopher Bort
<topher@...>
<http://www.thehundredacre.net/>