[2354] in SIPB-AFS-requests
BOGUS data from e.root-servers.net
daemon@ATHENA.MIT.EDU (John Hawkinson)
Sat Apr 27 06:13:25 1996
Date: Sat, 27 Apr 96 06:13:20 -0400
To: star-maintainers@MIT.EDU
From: John Hawkinson <jhawk@MIT.EDU>
Attached is mail I sent to network.
I've restarted named on bloom-picayune and penguin-lust. ra, rb, rc,
charon, bed, and closet were all unaffected.
Beacon's named is still propagating this info, could someone make sure
it gets restarted, please?
As for office machines, only limekiller and slarti were affected;
thornhump does not not appear to be running a named.
Thanks.
--jhawk
Received: from SOUTH-STATION-ANNEX.MIT.EDU by po10.MIT.EDU (5.61/4.7) id AA03537; Sat, 27 Apr 96 06:
01:24 EDT
Received: from OPUS.MIT.EDU by MIT.EDU with SMTP
id AA22360; Sat, 27 Apr 96 06:01:23 EDT
Received: by opus.MIT.EDU (931110.SGI/4.7) id AA11802; Sat, 27 Apr 96 06:02:34 -0400
Date: Sat, 27 Apr 96 06:02:34 -0400
Message-Id: <9604271002.AA11802@opus.MIT.EDU>
To: network@MIT.EDU
Cc: dkk@MIT.EDU, op@MIT.EDU
Subject: Many mit.edu nameds (including mailhubs) infected with BOGUS root data
From: John Hawkinson <jhawk@MIT.EDU>
Tonight e.root-servers.net (formerly NS.NASA.GOV) got infected with
bogus data for . This was apparently a result of a failed
zone-transfer (or something) that left the .mil domain file as
zero-length.
It was advertising the following records for .:
. 172800 NS LOFT-GW.ZONE.ORG.
. 172800 NS NOC.CERF.NET.
. 172800 NS ITHIL.ZONE.ORG.
These have succeeded in polluting the mailhubs and other machines
around MIT (eg; bitsy), as well as many machines out on the Internet.
As of about 5:45am the NSI NOC had gotten ahold of someone who
corrected the problem, so it's fixed at the source.
Unfortunately there are a lot of nameds out there still caching the
wrong data.
I would suggest that any important servers that do a lot of DNS
queries (eg: mailhubs and nameservers) should be restarted as soon as
convenient.
Thanks.
--jhawk
[all-purpose-gunk!jhawk] ~> dig +norec +d2 @e.root-servers.net . ns
; <<>> DiG 2.1 <<>> +norec +d2 @e.root-servers.net . ns
; (1 server found)
;; res_mkquery(0, ., 1, 2)
;; res options: init debug defnam dnsrch ?0x80000000?
;; res_send()
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10
;; flags:; Ques: 1, Ans: 0, Auth: 0, Addit: 0
;; QUESTIONS:
;; ., type = NS, class = IN
;; Querying server (# 1) address = 192.203.230.10
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10
;; flags: qr; Ques: 1, Ans: 3, Auth: 0, Addit: 1
;; QUESTIONS:
;; ., type = NS, class = IN
;; ANSWERS:
. 172800 NS LOFT-GW.ZONE.ORG.
. 172800 NS NOC.CERF.NET.
. 172800 NS ITHIL.ZONE.ORG.
;; ADDITIONAL RECORDS:
ITHIL.ZONE.ORG. 172800 A 199.106.62.3
;; Total query time: 114 msec
;; FROM: all-purpose-gunk.near.net to SERVER: e.root-servers.net 192.203.230.10
;; WHEN: Sat Apr 27 05:11:00 1996
;; MSG SIZE sent: 17 rcvd: 106
[opus!jhawk] ~>
