From owner-freebsd-isp Tue Feb 27 17: 2:22 2001 Delivered-To: freebsd-isp@freebsd.org Received: from ns.internet.dk (ns.internet.dk [194.19.140.1]) by hub.freebsd.org (Postfix) with ESMTP id D37E437B71B for ; Tue, 27 Feb 2001 17:02:19 -0800 (PST) (envelope-from leifn@neland.dk) Received: (from uucp@localhost) by ns.internet.dk (8.11.2/8.11.2) id f1S12I589328 for freebsd-isp@FreeBSD.ORG.AVP; Wed, 28 Feb 2001 02:02:18 +0100 (CET) (envelope-from leifn@neland.dk) Received: (from uucp@localhost) by ns.internet.dk (8.11.2/8.11.2) with UUCP id f1S12IB89314; Wed, 28 Feb 2001 02:02:18 +0100 (CET) (envelope-from leifn@neland.dk) Received: from localhost (localhost [127.0.0.1]) by arnold.neland.dk (8.11.1/8.11.0) with ESMTP id f1S11wx18156; Wed, 28 Feb 2001 02:02:03 +0100 (CET) (envelope-from leifn@neland.dk) Date: Wed, 28 Feb 2001 02:01:57 +0100 (CET) From: Leif Neland To: Len Conrad Cc: freebsd-isp@FreeBSD.ORG Subject: bind attacks, was: tinydns In-Reply-To: <5.0.0.25.0.20010228000158.0436aeb0@mail.Go2France.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Wed, 28 Feb 2001, Len Conrad wrote: > > >There you go. I'm 99.9% sure the upgrade will fix it. > > Me, too, Troy. > > After months of stability with 8.2.3 TxB on NT4 and 8.2.2p5 on > FreeBSD, in early Feb, I began having named stopping (I suspect > script kiddies just taking down every DNS they could find). > The CERT advisories does not show any hole which just kills named. (If I read correctly). Is there any info for what has happened, and any way to try logging the ip of somebody trying to do it, now everybody naturally has updated bind? Leif To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message