We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

DNS patch slows BIND and Windows Server systems

But admins urged to continue running dodgy fix

DNS patches that were released to quash a critical flaw have slowed the servers running the Berkeley Internet Name Domain (BIND) software and had an adverse effect of some versions of Windows Server.

Paul Vixie, who heads the Internet Systems Consortium (ISC), the group responsible for the BIND software, acknowledged issues with the July 8 fix that was rolled out as part of a multi-vendor update meant to patch a cache poisoning flaw discovered months before by researcher Dan Kaminsky.

"During the development cycle we became aware of a potential performance issue on high-traffic recursive servers, defined as those seeing a query volume of greater than 10,000/queries per second," said Vixie in a message to a BIND mailing list.

"Given the limited time frame and associated risks we chose to finish the patches ASAP and accelerate our work on the next point releases that would address the high-volume server performance concerns. Our immediate goal was to make patches publicly available as soon as possible," Vixie explained.

Vixie wasn't specific about the extent of the performance problems facing high-volume DNS servers, but said that a second round of patches, due later this week, will remedy port allocation issues and "allow TCP queries and zone transfers while issuing as many outstanding UDP queries as possible".

Versions of the second update, which will be designated P2 when they're unveiled, are currently available in beta form for BIND 9.4.3 and BIND 9.5.1.

However, Vixie stressed that administrators shouldn't roll back the July 8 patched editions even if their servers were running slowly. "Until the release of the -P2 code, it is imperative that you run a -P1 version of BIND on your caching resolvers," he said. "The vulnerability is of more concern than a slow server."

The flaw Kaminsky uncovered in February makes it much easier than originally thought to insert bogus information into the internet's routing infrastructure. A successful attack would let criminals silently redirect requests for a legitimate site to a bogus one set up to skim personal information, such as passwords to online banking accounts, from duped users.

Earlier this month, when Kaminsky announced that the vulnerability had been patched by several vendors, including ISC, Microsoft and Cisco Systems, he applauded their quick co-operation.

"I want to get a lot of credit to the vendors here," he said.

"The vendors were everything that the security community ever could have asked for," he said, referring to the resources they allocated to the problem and the speed with which they cranked out patches."

NEXT PAGE: Other vendors involved in first-round DNS patching

Visit Security Advisor for the latest internet threat news, FREE net threat email newsletters, and internet security product reviews


IDG UK Sites

Best Black Friday 2014 tech deals: Get bargains on smartphones, tablets, laptops and more

IDG UK Sites

What the Internet of Things will look like in 2015: homes will get smarter, people might get fitter

IDG UK Sites

See how Trunk's animated ad helped Ade Edmondson plug The Car Buying Service

IDG UK Sites

Yosemite tips: Complete Guide to OS X Yosemite