dig source port patch

Jonathan de Boyne Pollard J.deBoynePollard at tesco.net
Wed Sep 3 19:16:51 UTC 2003


SW> Have you[, Jim,] successfuly spoofed DNS cache blind?

"Never attribute to malice ..." and all that, but it is worth pointing out
that one possible (albeit not the most probable by a long shot) explanation
for the symptoms observed by Duane J. Von Lanken in this forum just over a
wekk ago is an attacker flooding his network with forged responses to an "NS"
query for ".".  (This would be one of the more effective ways of hijacking
resolving proxy DNS server softwares that use the "root hints" paradigm.)


More information about the bind-users mailing list