Re: potential DNS security issue

From: Chris (chris23_at_ic-2000.com)
Date: 12/21/04 

Date: Tue, 21 Dec 2004 15:21:46 -0500

Well, its working fine now that I cleared the DNS server cache in the
managment console. The root hints are correct I'm thinking of forwarding
requests to my unix box because this has only happened to the windows 2000
server. But my concern is that I have no idea how this kind of problem
happened in the first place...

"Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
news:do%xd.235585$V41.180494@attbi_s52...
> OK. Well I don't know the answer to what is going on and you said you have
> secure cache against pollution already selected. What might be
> interesting is to configure your internals dns server to either use root
> hints only or forward to your ISP dns server only to see if it makes a
> difference which one you use to resolve your internet names. If your ISP
> has multiple dns servers, try using a different dns server than you are
> now. --- Steve
>
>
> "Chris" <chris23@ic-2000.com> wrote in message
> news:8S_xd.14270$6N6.4605@fe10.lga...
>> It was definately the server. I tried the ipconfig /flushdns first and
>> that didn't fix anything. It only cleared up after I cleared the cache
>> in the management console. It was happening on all clients using this
>> dns server as well, of course. Everything resolved to same IP except
>> zones this server serves.
>>
>> "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
>> news:vE_xd.302355$R05.85785@attbi_s53...
>>> That is scary. Did you clear the client cache via ipconfig /flushdns or
>>> did you clear the dns server cache via the dns Management Console where
>>> you have to find the cached lookups folder, right click and select clear
>>> cache? You have to select view-advanced to see the cached folder. Also
>>> when you use nslookup on a computer doing that do all names [Yahoo.com,
>>> Microsoft.com, etc] resolve to the same IP addresses. I am wondering if
>>> it is a dns client or dns server problem. --- Steve
>>>
>>>
>>> "Chris" <chris23@ic-2000.com> wrote in message
>>> news:luZxd.14261$n26.1929@fe10.lga...
>>>>I posted this to the dns group, but thought it might be appropriate here
>>>>too. I think this is a security issue as well:
>>>>
>>>> This morning on of our DNS servers started responding to all requests
>>>> with the same IP address. The only exceptions were sites that the
>>>> server was authoritative for. I fixed it by clearing the cache, but I
>>>> have to wonder how this is happening. This server runs Windows 2000
>>>> dns and has the "secure cache against pollution" option set (and I
>>>> confirmed it in the registry).
>>>>
>>>> I contacted Microsoft and they had no idea what might be happening.
>>>> They thought that one of the root servers may have been compromised. I
>>>> find this hard to believe however. I found this link on the web:
>>>> http://www.atsnn.com/story/105049.html which describes a similar
>>>> situation. It appears that this has occured to others over the last few
>>>> weeks, and any root server problems probably would have been dealt
>>>> with.
>>>>
>>>> Has anyone seen this before. It seems like a vulnerability that has
>>>> not yet been addressed. However, maybe its just a vulnerability in DNS
>>>> in general. Any thoughts?
>>>>
>>>
>>>
>>
>>
>
>

Relevant Pages

  • RE: strange DNS behavior over the last 2 days
    ... when I see different results from NSLOOKUP and PING, ... NetBIOS names, you might consider confirming your firewall blocks NetBIOS ... you might read the article at www.cert.org concerning DNS cache ... machines and regardless of which DNS server we point them to, ...
    (Incidents)
  • Re: Track DNS Requests
    ... > look at a cache of requests. ... Technically this is more a cache of responses than requests since ... DNS server had to ask other servers. ...
    (microsoft.public.windows.server.dns)
  • Re: preventing caching on DNS server
    ... > for the record again UNLESS it does not have it anymore in its Cache. ... should just be configured to use the UPSTREAD DNS server ... >> forwarded lookups? ... >> Config: ...
    (microsoft.public.win2000.dns)
  • Re: Dns Cache -- Thanks for any help
    ... The intranet dns servers are caching, ... When I look in the cache on my XP ... >> to the local dns server and it cannot locally resolve but must forward ... >> the remote internet dns server that was used as a forwarder? ...
    (microsoft.public.win2000.dns)
  • Re: Dns Cache -- Thanks for any help
    ... The intranet dns servers are caching, ... When I look in the cache on my XP ... >> to the local dns server and it cannot locally resolve but must forward ... >> the remote internet dns server that was used as a forwarder? ...
    (microsoft.public.windows.server.dns)