Antwort: Re: [Snort-users] New BIND exploit...

holger.bumke at ...1216... holger.bumke at ...1216...
Tue Jan 30 08:38:11 EST 2001


Hi!

As a quick workaround any user of BIND 8 can hide the version-number of his named in the named.conf by adding

     version "Skript-Kiddies: go away!";

in the "options { }"-Section.

Though "dig" will give this result:
[user at ...1233...]:# dig @dns.ser.ver txt chaos version.bind | grep VERSION
VERSION.BIND.           0S CHAOS TXT    "Skript-Kiddies: go away!"

Or confuse diggers with a version like 9.5  =:^))))

This is only a fast help.
Don't forget to upgrade. ;)

Regards
   Holger







Borja Marcos <borjamar at ...778...> am 30.01.2001 13:55:47

An:   snort-users at lists.sourceforge.net
Kopie:     (Blindkopie: Holger Bumke/nbg/DE)

Thema:    Re: [Snort-users] New BIND exploit...




Peter Bates wrote:

[...]

     I haven't seen any exploits, but have detected an increase
on bind.version queries.

     Someone from 210.178.239.1 is scanning all the .es
nameservers, it seems.

     Regards,

     Borja.







More information about the Snort-users mailing list