[17570] in bugtraq
Re: BIND 8.2.2-P5 Possible DOS
daemon@ATHENA.MIT.EDU (Akatosh)
Thu Nov 9 02:36:12 2000
MIME-Version: 1.0
Content-Type: MULTIPART/MIXED; BOUNDARY="2122730985-1975780877-973722555=:11370"
Message-ID: <Pine.LNX.4.10.10011081722270.11370-200000@flight.rains.net>
Date: Wed, 8 Nov 2000 17:29:15 -0500
Reply-To: Akatosh <akatosh@RAINS.NET>
From: Akatosh <akatosh@RAINS.NET>
X-To: naif@inet.it
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <Pine.LNX.4.30.0011071339510.29294-100000@naif.inet.it>
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
Send mail to mime@docserver.cac.washington.edu for more info.
--2122730985-1975780877-973722555=:11370
Content-Type: TEXT/PLAIN; charset=US-ASCII
>
> I should assume that bind 8.2.2-P5 it's vulnerable ( Please someone test and confirm this kind of dos)
> and bind-9.0.0 has no support for ZXFR .
>
> <naif@naif> [~/bind] $ find src822p5/ -type f -exec grep -i zxfr \{\} ';' | wc -l
>
HMM
yep
my bind crashed
attatched is my half-assed patch
-----------
Akatosh
akatosh@rains.net
DC2.DfGmL--WT--SksCre+\Cvi+BflN^MH++$-Fj~R+Ac+++!J+S+U-I--#V++[sumobj]Q+Tc++
GCSd-s:-a---C++++UL++++P---L++++E-W++N+o?K-w---O-M--V-PS+PE?YPGPt+5++XR*!tvb++(+++)DI++D++Geh+r--z-
--2122730985-1975780877-973722555=:11370
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="ns_xfr.c.patch"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.LNX.4.10.10011081729150.11370@flight.rains.net>
Content-Description:
Content-Disposition: attachment; filename="ns_xfr.c.patch"
LS0tIHNyYy9iaW4vbmFtZWQvbnNfeGZyLmMJV2VkIE9jdCAxMyAxMjozOTox
MyAxOTk5DQorKysgc3JjLm5ldy9iaW4vbmFtZWQvbnNfeGZyLmMJV2VkIE5v
diAgOCAxNjo1MzozOCAyMDAwDQpAQCAtOTcsNyArOTcsOCBAQA0KIAkJCSAg
ICJ1bnN1cHBvcnRlZCBYRlIgKHR5cGUgJXMpIG9mIFwiJXNcIiAoJXMpIHRv
ICVzIiwNCiAJCQlwX3R5cGUodHlwZSksIHpvbmVzW3pvbmVdLnpfb3JpZ2lu
LCBwX2NsYXNzKGNsYXNzKSwNCiAJCQlzaW5fbnRvYShxc3AtPnNfZnJvbSkp
Ow0KLQkJZ290byBhYm9ydDsNCisJCSh2b2lkKSBzaHV0ZG93bihxc3AtPnNf
cmZkLCAyKTsNCisJCWdvdG8gYWJvcnQyOw0KIAl9DQogDQogI2lmZGVmIFNP
X1NOREJVRg0KQEAgLTE5NSwxMSArMTk2LDEzIEBADQogCQkJdHlwZSA9IG5z
X3RfYXhmcjsNCiAJfQ0KIAkJaWYgKHN4X3B1c2hsZXYocXNwLCB6bnApIDwg
MCkgew0KKw0KICBhYm9ydDoNCiAJCQkodm9pZCkgc2h1dGRvd24ocXNwLT5z
X3JmZCwgMik7DQogCQkJc3FfcmVtb3ZlKHFzcCk7DQogCQkJcmV0dXJuOw0K
IAkJfQ0KKyBhYm9ydDI6DQogCWlmICh0eXBlICE9IG5zX3RfaXhmcikgDQog
CQkodm9pZCkgc3Ffd3JpdGVoKHFzcCwgc3hfc2VuZHNvYSk7DQogCWVsc2Ug
DQo=
--2122730985-1975780877-973722555=:11370--
