Repository :
http://git.fedorahosted.org/cgit/docs/networking-guide.git
On branch : master
---------------------------------------------------------------
commit 675bd1aeac7e42c2253372e4c29ea626899dfa3a
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Mon Jul 21 21:51:44 2014 +0200
Avoid using fixed UDP source ports
Improve the warning
---------------------------------------------------------------
en-US/BIND.xml | 3 +--
1 files changed, 1 insertions(+), 2 deletions(-)
diff --git a/en-US/BIND.xml b/en-US/BIND.xml
index 3185f35..f9f5eb7 100644
--- a/en-US/BIND.xml
+++ b/en-US/BIND.xml
@@ -1908,8 +1908,7 @@
ns.icann.org. 12884 IN A 192.0.34.126
<warning
id="warning-Warning-Avoid_Using_Fixed_UDP_Source_Ports">
<title>Avoid using fixed UDP source ports</title>
<para>
- According to the recent research in DNS security, using a fixed UDP source
port for DNS queries is a potential security vulnerability that could allow an attacker to
conduct cache-poisoning attacks more easily. To prevent this, configure your firewall to
allow queries from a random UDP source port.
- </para>
+ Using a fixed <systemitem
class="protocol">UDP</systemitem> source port for <systemitem
class="protocol">DNS</systemitem> queries is a potential security
vulnerability that could allow an attacker to conduct cache-poisoning attacks more easily.
To prevent this, by default <systemitem
class="protocol">DNS</systemitem> sends from a random ephemeral port.
Configure your firewall to allow outgoing queries from a random <systemitem
class="protocol">UDP</systemitem> source port. The range
<literal>1024</literal> to <literal>65535</literal> is used by
default.</para>
</warning>
</listitem>
</varlistentry>