On Jul 25, 2008, at 11:11 AM, Simon Slavin wrote: On 25 Jul 2008, at 3:36pm, Dave Pooser wrote: Nope, that's why I entrust DNS to folks smarter than me.
Hopefully they're smart enough not to use OS X server to host DNS.
This is sort-of the point I failed to make earlier: this vulnerability can be patched only if you're providing your own DNS service. The original poster said they were running /one/ server. So obviously ( :-) ) they're not providing DNS service. Therefore they don't need to do anything about it.
You need to have two (or more) servers if your serving authoritative zone records, he could very well be running a recursive caching server with just one box where this attack would still be valid.
|
