How To Prevent Against DNS Cache Poisoning (CA-1997-22)?

This vulnerability is quite old (1997), but points to a problem inherent in DNS. The vulnerability is exploited by sending a high number of DNS queries to a vulnerable DNS server with the same amount of false replies. It creates a race condition to see if the system can guess the right transaction ID for the DNS server to cache the false reply.

Palo Alto Networks has a number of DNS cache poisoning signatures for specific vendors, as well as, a general brute force signature to detect this type of activity. Look at TID 40003 for the general threshold based signature and 35190, 31349, and 31123 for specific vendor DNS cache poisoning vulnerabilities.

owner: rvanderveken