Re: [cobalt-security] Fwd: [EXPL] BIND 8.2.2-P5 DoS vulnerability(exploit, BIND_ZXFR)

[Jeff Lovell <jlovell@xxxxxxxxxx>]

Gossi The Dog wrote:
>
> Jeff from Cobalt usually lurks here, but we haven't heard from him
> recently.  

Busy times...

> Cobalt have the mail address security@xxxxxxxxxx, if you are
> concerned.

As a measure to prevent attacks, you can add the following
to the options section in your /etc/named.conf

allow-transfer { none; };

and run /etc/rc.d/init.d/named restart

Here is the modified default named.conf:

options { directory "/etc/named"; allow-transfer { none; }; };
zone "." { type hint; file "db.cache"; };

See if that will stop it from crashing for now.  But you
will not be able to do zone transfers.  If you still need
to do zone transfers, put in the address/net to allow access.

'man named.conf' for more details.

Jeff

-- 
Jeff Lovell
Cobalt Networks, Inc.