Companies rushed to upgrade DNS (Domain Name System) software after warnings were issued in late January about a flaw in widely-used DNS software. In the past weeks, however, upgrading has come to a halt, concludes Iceland-based DNS consultancy and software firm Men & Mice.
Reykjavik-based Men & Mice tested the DNS systems for the Web sites of Fortune 1000 companies and random .com domains at set dates after the alerts were released. The results were made public on the company’s site. The Computer Emergency Response Team (CERT) at Carnegie Mellon University, meanwhile, said that it has begun receiving reports of BIND (Berkeley Internet Name Domain) holes being successfully exploited.
BIND, distributed free by the Internet Software Consortium (ISC), is software run by companies and ISPs to translate text-based Internet addresses into numbered IP (Internet Protocol) addresses. Versions including both 4.9.x prior to 4.9.8 and 8.2.x are not secure, according to CERT.
OpenMail to be closed down
Hewlett-Packard Co.’s confirmation that it has released what will be the final version of OpenMail caught users off guard and left them scrambling to find a viable path for their messaging-system future.
HP said Version 7.0, a beta of which was released for download recently, will end the OpenMail line. It will continue to support the product for five years, the company said.
Flaw revealed in Cisco IOS software
Cisco Systems Inc. has warned customers of a flaw in its Internetwork Operating System (IOS) software that could compromise the integrity of TCP (Transmission Control Protocol) traffic sent to and from its routers and switches.
The vulnerability exists in all released versions of IOS, and hence affects all Cisco routers and switches running the software, the company said in a security advisory. The security flaw can allow the successful prediction of TCP Initial Sequence Numbers, Cisco said. This enables hackers, “with varying degrees of success, to forge one half of a TCP connection with another host in order to gain access to that host, or hijack an existing connection between two hosts in order to compromise the contents of the TCP connection,” Cisco said in the advisory.
