potential DNS security issue

From: Chris (chris23_at_ic-2000.com)
Date: 12/21/04 

Date: Tue, 21 Dec 2004 12:53:57 -0500

I posted this to the dns group, but thought it might be appropriate here
too. I think this is a security issue as well:

This morning on of our DNS servers started responding to all requests with
the same IP address. The only exceptions were sites that the server was
authoritative for. I fixed it by clearing the cache, but I have to wonder
how this is happening. This server runs Windows 2000 dns and has the
"secure cache against pollution" option set (and I confirmed it in the
registry).

I contacted Microsoft and they had no idea what might be happening. They
thought that one of the root servers may have been compromised. I find this
hard to believe however. I found this link on the web:
http://www.atsnn.com/story/105049.html which describes a similar situation.
It appears that this has occured to others over the last few weeks, and any
root server problems probably would have been dealt with.

Has anyone seen this before. It seems like a vulnerability that has not yet
been addressed. However, maybe its just a vulnerability in DNS in general.
Any thoughts?

Relevant Pages

  • Re: RPC is unavailable when try to transfer FSMO Roles
    ... on the DNS server ... Registry value: DnsAvoidRegisterRecords ... To stop registration of both NICs, add or alter this ...
    (microsoft.public.windows.server.active_directory)
  • Re: RPC is unavailable when try to transfer FSMO Roles
    ... prevent the public interface addresses from being registered in DNS. ... In the DNS management console, in the properties of the DNS server, ... Registry value: DnsAvoidRegisterRecords ... To stop registration of both NICs, add or alter this reg ...
    (microsoft.public.windows.server.active_directory)
  • Re: SBS 2003 and Replication Errors with Remote DC
    ... I did make the changes that you suggested on the DNS of my alpha server and rebooted. ... I did run the simple DNS test that you suggested by adding a host record to my SBS server. ... A simple DNS replication test is to create a host record in the SBS server and wait till it shows up in the remote server. ...
    (microsoft.public.windows.server.sbs)
  • Re: Permissions across 2 Forrest
    ... Primary DNS server on 1.x and the 18.x network along with DHCP and WINS. ... For instance ForrestA DNS is now a secondary for Forrest B and vise versa. ... WINS clients must use the same "WINS Database"* ...
    (microsoft.public.windows.server.active_directory)
  • Re: SBS 2003 and Replication Errors with Remote DC
    ... alpha server as soon as you can to get things going. ... A simple DNS replication test is to create a host record in the SBS server ... Domain Controller Diagnosis ...
    (microsoft.public.windows.server.sbs)