Something new? bind dos? exploit?

From: Chip Mefford (cmefford_at_avwashington.com)
Date: 02/13/04

  • Next message: jlewis_at_lewis.org: "Re: Something new? bind dos? exploit?" 
    Date: Fri, 13 Feb 2004 07:06:59 -0500
To: incidents@securityfocus.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    ~From the logs;

    Feb 13 06:55:40 hostname named[12631]: socket.c:1100: unexpected error:
    Feb 13 06:55:40 hostname named[12631]: internal_send:
    244.254.254.254#53: Invalid argument

    First noticed this yesterday on one of my "just for fun"
    machines. Bind 9.1.3 just up and died after about 6 months
    of painless trouble free uptime with this last gasp
    in the logs;

    Feb 11 19:57:39 ns named[4162]: message.c:782: REQUIRE(*rdataset ==
    ((void *)0)) failed
    Feb 11 19:57:39 ns named[4162]: exiting (due to assertion failure)

    I've since built 9.2.3 for this box, after checking for root
    kits, and the usual suspects. (I got stung pretty badly about
    6 years ago over that bind-4 trojan). Then I noticed
    the above log entry.. Never seen these before, going back
    2 months in the logs, not ever seen anything like it.

    All of my machines running bind 9.1.3 or higher, have not
    been touched for months. All of them are seeing this traffic,
    including ones not on my subnet.

    All are linux, but are running different flavors of the 2.4 kernel,
    on different x86 hardware, all running source built bind (that has
    otherwise been completely clean for many months).

    Any clues? insights? anyone else seeing this?

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.4 (GNU/Linux)
    Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

    iD8DBQFALL3hKwBdjKaYQmYRAhs5AJ4k2NacjSxAAcbux0uhKDPJadtf1wCdFLtr
    XNnLG4WnskiV00lmcOTqWWs=
    =nm3+
    -----END PGP SIGNATURE----- 

    -- 
This message has been scanned for viruses and
dangerous content, and is believed to be clean.
---------------------------------------------------------------------------
Free trial: Astaro Security Linux -- firewall with Spam/Virus Protection
Protect your network with the comprehensive security solution that
integrates six applications for ease of use and lower TCO.
Firewall - Virus protection - Spam protection - URL blocking - VPN
- Wireless security.
Download 30-day evaluation at:
http://www.astaro.com/php/contact/securityfocus.php
----------------------------------------------------------------------------
  • Next message: jlewis_at_lewis.org: "Re: Something new? bind dos? exploit?"

    Relevant Pages

    • Re: Nameserver
      ... >I'd like to set up BIND locally to resolve names between machines on my ... >primary nameserver. ... configure your local machines to point to this box as their DNS server. ... Or you can read the DNS HOWTO at The Linux Documentation Project ...
      (RedHat)
    • Re: /var partition overflow (due to spyware?) in FreeBSD default install
      ... > FreeBSD machines with default installs of the operating system. ... > verified it yet) that the problem is due to the New.Net spyware, ... It may also pay to patch BIND to limit the overhead that is ... log files and rotate them when needed and turn off logging to syslog. ...
      (FreeBSD-Security)
    • Re: how can I test the security of my Linux box ?
      ... Very few ppl are interested in going to jail for helping someone ... Just as BIND - use djbDNS instead of BIND. ... > SATAN is also another program to try on to test your security. ... Satan is quite old - Nessus will be much better nowadays. ...
      (comp.os.linux.security)
    • Re: Waiting for BIND security announcement
      ... include the fixes that the security officer deems important enough to ... I can't speak for the security team, but I'm pretty sure that this ... There is even an option in the port to overwrite the base BIND ... name server to the big bad world while tracking RELENG_N_M ("release ...
      (freebsd-questions)
    • Re: ADAM - New users reading data - best practices
      ... You bind to the directory (or the connection to the ... AUTHENTICATED USERS built-in security principal for your ACL entries. ...
      (microsoft.public.windows.server.active_directory)