Dynamic DNS Vulnerability

From: 3xT (awacsat_private)
Date: Mon Aug 30 1999 - 16:36:19 PDT

Next message: Cristian Gafton: "[SECURITY] RHSA-1999:034 New proftpd packages available"

Previous message: Prince Ctrl: "RH 6.0 shadowed users and user lock bug fix"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Sorry, hit enter in the first one thinking it would tab
down.

Here it is:

Currently most inplementations of Dynamic DNS or "DDNS" rely
upon only client IP addresses in an access list for
authentication.  The impact is that anyone can spoof update
packets from a false source address and the server will
happily accept them.   I am going to include the URL to a
tool that can be used to exploit the vulnerability. 
Hopefully vendors will strive to do what's right in a timely
fasion.

Spoofer Utility: http://www.3xt.org/projects

Download ddns.tar.gz from there.

Best Wishes,

-awacs
3xT

Next message: Cristian Gafton: "[SECURITY] RHSA-1999:034 New proftpd packages available"
Previous message: Prince Ctrl: "RH 6.0 shadowed users and user lock bug fix"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:00:54 PDT