[red@localhost ~]$ dig isc.org NS
; <<>> DiG 9.3.4 <<>> isc.org NS
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20945
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 2
;; QUESTION SECTION:
;isc.org. IN NS
;; ANSWER SECTION:
isc.org. 43200 IN NS ord.sns-pb.isc.org.
isc.org. 43200 IN NS ams.sns-pb.isc.org.
isc.org. 43200 IN NS sfba.sns-pb.isc.org.
isc.org. 43200 IN NS ns.isc.afilias-nst.info.
;; ADDITIONAL SECTION:
ams.sns-pb.isc.org. 43120 IN A 199.6.1.30
ord.sns-pb.isc.org. 43061 IN A 199.6.0.30
;; Query time: 24 msec
;; SERVER: 68.87.76.182#53(68.87.76.182)
;; WHEN: Sat Nov 6 19:01:23 2010
;; MSG SIZE rcvd: 156
[red@localhost ~]$ dig version.bind txt chaos @sfba.sns-pb.isc.org
; <<>> DiG 9.3.4 <<>> version.bind txt chaos @sfba.sns-pb.isc.org
; (2 servers found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18238
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;version.bind. CH TXT
;; ANSWER SECTION:
version.bind. 0 CH TXT "9.6.2"
;; AUTHORITY SECTION:
version.bind. 0 CH NS version.bind.
;; Query time: 17 msec
;; SERVER: 149.20.64.3#53(149.20.64.3)
;; WHEN: Sat Nov 6 19:01:42 2010
;; MSG SIZE rcvd: 62
Saturday, November 06, 2010
digging for bind version
Subscribe to:
Post Comments (Atom)
https://my.controlscan.com/threats/details.cgi?id=500354 explains issues with bind "9.6.1-P2"
ReplyDeletealso check here:
ReplyDeletehttps://www.info-point-security.com/component/k2/itemlist/tag/server.html?start=60
something about:
ReplyDelete$data = request.get( 3 );
if ( string.regexmatch($data, "..[()]" ) ) {
log.warn("FOUND UPDATE PACKET");
connection.discard();
}
http://xss.cx/examples/nexpose/nexpose-sample-xss-report-2.pdf
ReplyDeleteoh cool
ReplyDeletehttp://lists.grok.org.uk/pipermail/full-disclosure/
Subject: [Full-disclosure] [ GLSA 200908-02 ] BIND: Denial of Service
ReplyDeleteMessage-ID: <20090801220423.38f0a595@neon>
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200908-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: BIND: Denial of Service
Date: August 01, 2009
Bugs: #279508
ID: 200908-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Dynamic Update packets can cause a Denial of Service in the BIND
daemon.
Background
==========
ISC BIND is the Internet Systems Consortium implementation of the
Domain Name System (DNS) protocol.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-dns/bind < 9.4.3_p3 >= 9.4.3_p3
Description
===========
Matthias Urlichs reported that the dns_db_findrdataset() function fails
when the prerequisite section of the dynamic update message contains a
record of type "ANY" and where at least one RRset for this FQDN exists
on the server.
Impact
======
A remote unauthenticated attacker could send a specially crafted
dynamic update message to the BIND daemon (named), leading to a Denial
of Service (daemon crash). This vulnerability affects all primary
(master) servers -- it is not limited to those that are configured to
allow dynamic updates.
Workaround
==========
Configure a firewall that performs Deep Packet Inspection to prevent
nsupdate messages from reaching named. Alternatively, expose only
secondary (slave) servers to untrusted networks.
Resolution
==========
All BIND users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-dns/bind-9.4.3_p3"
References
==========
[ 1 ] CVE-2009-0696
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0696
[ 2 ] ISC advisory
https://www.isc.org/node/474
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200908-02.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security at gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2009 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
-------------- next part --------------
So a nsupdate sesion looked like...
ReplyDelete[root@foo named]# nsupdate -v -d
> key remote.testdomain.ca. fE6D3.....IklFtmj14o=
> server myserver.mydomain.com
> zone testdomain.ca
> update delete remote.testdomain.ca. A
> update add remote.testdomain.ca. 600 IN A 4.3.2.1
> show
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0
;; flags: ; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0
;; UPDATE SECTION:
remote.testdomain.ca. 0 ANY A
remote.testdomain.ca. 600 IN A 4.3.2.1
> send
Sending update to 1.2.3.4#53
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 39822
;; flags: ; ZONE: 1, PREREQ: 0, UPDATE: 2, ADDITIONAL: 1
;; ZONE SECTION:
;testdomain.ca. IN SOA
;; UPDATE SECTION:
remote.testdomain.ca. 0 ANY A
remote.testdomain.ca. 600 IN A 4.3.2.1
;; TSIG PSEUDOSECTION:
remote.testdomain.ca. 0 ANY TSIG hmac-md5.sig-alg.reg.int. 1302047875 300 16 gBRZ.......sVeRg== 39822 NOERROR 0
Reply from update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOTAUTH, id: 39822
;; flags: qr ra ; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 1
;; TSIG PSEUDOSECTION:
remote.testdomain.ca. 0 ANY TSIG hmac-md5.sig-alg.reg.int. 1302047875 300 16 I78yRo2.......RQU50w== 39822 NOERROR 0
The status: NOTAUTH error was because the testdomain.ca was in the external view and I was running nsupdate on localhost.