error sending response log messages

[Mark Andrews]

In message <497CAEF2.80806 at yahoo.com>, Andre LeClaire writes:
> Hello everyone,
> I've been seeing these syslog messages for about a week on a FreeBSD 
> server running BIND 9.4.3-P1:
> 
> Jan 25 02:35:21 asimov named[145]: client 206.71.158.30#138: error 
> sending response: permission denied
> Jan 25 03:43:32 asimov named[145]: client 206.71.158.30#138: error 
> sending response: permission denied
> Jan 25 04:49:59 asimov named[145]: client 206.71.158.30#139: error 
> sending response: permission denied
> Jan 25 05:15:40 asimov named[145]: client 66.230.160.1#139: error 
> sending response: permission denied
> Jan 25 07:45:11 asimov named[145]: client 206.71.158.30#139: error 
> sending response: permission denied
> Jan 25 07:56:26 asimov named[145]: client 206.71.158.30#138: error 
> sending response: permission denied
> Jan 25 08:10:29 asimov named[145]: client 206.71.158.30#138: error 
> sending response: permission denied
> Jan 25 08:54:34 asimov named[145]: client 206.71.158.30#138: error 
> sending response: permission denied
> Jan 25 09:16:41 asimov named[145]: client 206.71.158.30#138: error 
> sending response: permission denied
> Jan 25 10:03:51 asimov named[145]: client 206.71.158.30#445: error 
> sending response: permission denied
> 
> Ports 135-139 and 445 are denied by the firewall on the outside 
> interface.

	Why do you care about what port you are sending to?  Just
	allow named to send its replies.

> It looks like it might be some kind of Windows exploit, but 
> I've Googled and searched the BIND mailing lists, and haven't found any 
> clues yet.
> Has anybody else seen this?
> 
> Thanks!
> 
> Andre
> 
> _______________________________________________
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark_Andrews at isc.org