From owner-freebsd-security Sat Mar 13 11: 4:59 1999 Delivered-To: freebsd-security@freebsd.org Received: from dhabat.pair.com (dhabat.pair.com [209.68.1.219]) by hub.freebsd.org (Postfix) with ESMTP id D80A814ED7 for ; Sat, 13 Mar 1999 11:04:54 -0800 (PST) (envelope-from alanp@dhabat.pair.com) Received: (from alanp@localhost) by dhabat.pair.com (8.9.1/8.6.12) id OAA27024; Sat, 13 Mar 1999 14:04:28 -0500 (EST) X-Envelope-To: freebsd-security@freebsd.org Message-ID: <19990313140428.A26796@unixpower.org> Date: Sat, 13 Mar 1999 14:04:28 -0500 From: Alan To: Brett Glass Cc: freebsd-security@freebsd.org Subject: Re: bind 8.1.2 cache poisoning References: <4.1.19990313072602.00a6b430@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.91.1 In-Reply-To: <4.1.19990313072602.00a6b430@localhost>; from Brett Glass on Sat, Mar 13, 1999 at 07:29:26AM -0700 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sat, Mar 13, 1999 at 07:29:26AM -0700, Brett Glass wrote: > It can't be hard to poison the cache. Many daemons do reverse lookups > on hosts which connect to them, presenting a perfect opportunity to > send a spoofed response that gets into the cache. If the "claimed" > name and the spoofed one match, they can get stuck for a very long > time (just make the time to live very long on purpose). > > For a standard that holds the Internet together, it is amazing just > how weak and awkward DNS really is. > > --Brett > The main server people are hitting is a.root-servers.net, they use this for non-existant domains. Messing with the root-servers is just wrong. -- | Alan L. * Webmaster of www.UnixPower.org | | Windsor Unix Users Group Founder: http://unix.windsor.on.ca/ | | Personal Page: http://www.unixpower.org/alanp/ | To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message