--9jxsPFA5p3P2qPhR Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Hello all, I am not sure if this is known or even relevant to the list and if not, please excuse this post. There appears to be a bug in the niu DNS setup process which could result in a DOS attack for those using their domains. For those unfamiliar with niu, they provide sub-domain service under the .nu domain to machines which do there own DNS. I have written to them on several occasions about this issue but as of yet have received no response. OK the bug is that any user who is willing to pay the $25 to register a =2Enu domain can knock out or redirect a host under another. This is best shown through an example. I register mycompany.nu and in the registration form enter the hosts I have doing the DNS for it. Name: mycompany.nu DNS1: machine.someserver.com DNS2: machine2.someserver.com After this step, my DNS entry in the .nu table looks like this $ORIGIN nu. mycompany IN NS machine2.someserver.com. IN NS machine2.someserver.com. mycompany.nu for the sake of this example had the following DNS table. $ORIGIN nu. mycompany IN SOA mymachine.mycompany.nu. hostmaster.mycompany.nu. ( 1 301 120 604800 600 ) IN NS machine1.someserver.com.=20 IN NS machine2.someserver.com. $ORIGIN mycompany.nu. mymachine IN A 192.168.1.1 So Al's well until someone registers evil.nu with the goal of knocking out myserver.mycompany.nu. On the form, they enter the following. name: evil.nu DNS1: mymachine.mycompany.nu DNS1IP: 127.0.0.1 Now here's the bug, if you enter an IP for a machine which falls under the =2Enu name-space, it maps it statically. It does not check to see if it falls under your name-space. Therefore, our evil.nu entry in the .nu table looks like this. $ORIGIN nu. evil IN NS mymachine.mycompany.nu. $ORIGIN mycompany.nu. mymachine IN A 127.0.0.1 So the IP for mymachine.mycompany.nu has been redirected from its 192.168.1.1 to 127.0.0.1. An attacker could conceivably redirect the mail servers of a company to his own machine or anything to that effect. Regards, Shane --=20 Shane Wegner: shaneat_private Tel: (604) 930-0530 Sysadmin, Continuum Systems: http://www.cm.nu Personal website: http://www.cm.nu/~shane ICQ UIN: 120000 PGP: keyid: 2048/F5C2BD91 Fingerprint: 8C 48 B9 D8 53 BB D8 EF 76 BB DB A2 1C 0D 1D 87 --9jxsPFA5p3P2qPhR Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v0.9.2 (GNU/Linux) Comment: md5 iQEVAwUBNs+Xi3ernFT1wr2RAQH7xggAhLlJ/7tTDDXkjidueiZSdVeomKZtn8Rb xNN49WcucAD9HUQw99ON654rABeKgPtx7lV/4MRjmZ6AhHd43Ho/Vloql/c841IO YeH1qgX1J55Qahi786fLoz5h/bA4HN6CUyG4viqfe4uyQ9VkggYgd5Tg6+9dD6+a T5IVpu2sTU6G8lJb7QEco3ir3W1o/6FYrr2PK+oXLoIVnT7qHb2/ErEstQ9zMP6k zhhGnRAmp7L/FLvpmpER9yCrY7z8h4K2kM1e+J5bYJXaS5PoZTgrE6wqVGdiHNpc EzMpob4HO/jSbkvq8kHiJB2V6PHthhBpMDb7Ws2OEYPErGAGMb0ZyA== =i/XG -----END PGP SIGNATURE----- --9jxsPFA5p3P2qPhR--
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:36:51 PDT