⚠ This page contains old, outdated, obsolete, … historic or WIP content! No warranties e.g. for correctness!
All 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
The CVE-2008-1447 does not, according to various sources, affect systems that randomise their source port. MirOS libc’s integrated resolver, according to some OpenBSD developers, does this, as does DJBDNS. The net/bind mirport is affected, but by using pf(4) to NAT yourself (thanks to Vutral for the suggestion), you can randomise these ports too. According to RUS-CERT, only using DNSSEC is a fix… I wonder if this is truth or advertising for a technique without wide-spread use.
