I was recently taking a look at the Apache Traffic Server project (which I believe was formerly developed by Yahoo Inc) and notice a series of potential problems relating to the way that it handles DNS. This proxy does not rely on the OS supplied resolver library for resolving hostnames but instead implements its own asynchronous resolver. Whilst reviewing the code, I spotted 3 potential issues which I believe might significantly increase the chances of Traffic Server's internal DNS cache being poisoned. The Apache Software Foundation have assigned CVE-2010-2952 to these issues. Tim --