[Snort-sigs] Fwd: fingerprinting BIND 9.1.0

Joseph Nicholas Yarbrough nyarbrough at ...5...
Tue Jan 30 14:02:28 EST 2001


heya... just fyi if you aren't on bugtraq.

----------  On Monday 29 January 2001 18:50, Max Vision wrote:  ----------
Subject: fingerprinting BIND 9.1.0
Date: Mon, 29 Jan 2001 15:50:31 -0800
From: Max Vision <vision at ...35...>
To: BUGTRAQ at ...16...


Hi,

The BIND 9.1.0beta releases and now BIND 9.1.0 include another hard coded
chaos record called "authors".  So now even if an admin changes or
suppresses their version reply string, a remote user can still determine
whether the server is running BIND 9.x.  With the recent discovery of the
tsig bug in BIND there will probably be a huge rise in version
queries.  Some attackers may remove ambiguity by skipping servers that
reply to authors.bind (inferring that it's bind 9.1.0 and not vulnerable).

% dig @ns.example.com authors.bind chaos txt

or

% nslookup -q=txt -class=CHAOS authors.bind. ns.example.com
Server:  ns.example.com
Address:  23.23.23.23

authors.bind    text = "Bob Halley"
authors.bind    text = "Mark Andrews"
authors.bind    text = "James Brister"
authors.bind    text = "Michael Graff"
authors.bind    text = "David Lawrence"
authors.bind    text = "Michael Sawyer"
authors.bind    text = "Brian Wellington"
authors.bind    text = "Andreas Gustafsson"

The following Snort signature will detect these probes:
alert UDP $EXTERNAL any -> $INTERNAL 53 (msg: "IDS480/named-probe-authors";
content: "|07|authors|04|bind"; depth: 32; offset: 12; nocase;)
http://whitehats.com/info/IDS480

Max

-------------------------------------------------------




More information about the Snort-sigs mailing list