Re: [Full-disclosure] bind-9.8.1 remote code exec exploit?
- From: Fabian Wenk <fabian@xxxxxxxx>
- Date: Sat, 29 Oct 2011 16:05:58 +0200
Hello
On 29.10.2011 15:34, nix@xxxxxxxxxxxxxxxx wrote:
I've source compile of BIND 9.8.1 on the server.
Is this bind server used as authoritative server for some DNS
domains? Or does your configuration allow to be queried from the
whole internet for resolving?
I've been investigating weird iptables messages as follows:
Oct 29 14:53:13 NIX kernel: IN= OUT=eth0 SRC=MY_SERVER_IP DST=62.80.128.29
LEN=114 TOS=0x00 PREC=0x00 TTL=64 ID=31795 PROTO=UDP SPT=53 DPT=5060
LEN=94
I received a message from my ISP abuse that my server is scanning SIP port
5060 and I set the firewall rule to deny/log all UDP connections out of
the box to port 5060 to get timestamps for further investigation. This
happened before I set the firewall rule.
For me this above log messages looks like a regular answer from
your DNS server to the client (or a resolving DNS server) running
on the destination IP address.
A DNS request runs like this:
A client (or resolving DNS server) does a query through UDP from
his source port 5060 (could be any other random port) to the
server on port 53. As UDP is connectionless, the server is
sending the answer back from his UDP port 53 to the destination
port 5060.
bye
Fabian
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- References:
- Prev by Date: [Full-disclosure] Gmail dangerous attachment type bypass
- Next by Date: Re: [Full-disclosure] bind-9.8.1 remote code exec exploit?
- Previous by thread: [Full-disclosure] bind-9.8.1 remote code exec exploit?
- Next by thread: Re: [Full-disclosure] bind-9.8.1 remote code exec exploit?
- Index(es):
Relevant Pages
|
