IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

One in four servers unpatched for Kaminsky flaw

Organisations and businesses worldwide are still leaving themselves open to DNS vulnerabilities.

Research has revealed that one in four servers is unpatched for the Kaminsky vulnerability.

This was according to an Infoblox survey of Domain Name System (DNS) servers, based on a survey of IPv4 address space sampling nearly 80 million addresses.

One in four servers did not perform source port randomisation, the patch' for the Kaminsky flaw. This removes the predictable nature of DNS source ports and replaces it with a randomised selection technique.

The patch was a multi-vendor effort which gave companies like Cisco and Microsoft the chance to fix the problem before attack code was circulated online.

It also required administrators to upgrade their name servers, but it was claimed that 40 per cent had not been upgraded. The research also revealed that only .002 per cent of DNS zones tested supported DNSSEC.

This left servers accepting open recursive queries from any inquirer, which were vulnerable to cache poisoning and Distributed Denial of Service attacks.

Cricket Liu, vice president of architecture at Infoblox, said that it was surprising that many organisations were still leaving themselves open to attack considering the awareness of the Kaminsky vulnerability.

He said: "Even if an enterprise has gone to the trouble of patching against the Kaminsky vulnerability, there are many other aspects of configuration, like recursion and open zone transfers that should also be secured.

"If not, organisations are essentially locking their door to their house, but leaving the windows wide open."

DNS servers are network infrastructure which maps domain names to IP addresses. Domain name resolution conducted by the servers is needed to perform any internet-related request.

The survey did reveal a bit off good news with the usage of unsecure' Microsoft DNS servers connected to the internet disappearing rapidly. Only 0.17 per cent of the addresses relied on it.

An IT PRO history of the Kaminsky flaw is available here.

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Most Popular

Cyber attack on software supplier causes "major outage" across the NHS
cyber attacks

Cyber attack on software supplier causes "major outage" across the NHS

8 Aug 2022
Why convenience is the biggest threat to your security

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022