~Toughbooktalk~ Rob - 630-300-8877

The largest Toughbook discussion site on the net!
It is currently Mon Sep 24, 2018 11:42 pm

All times are UTC-06:00




Post new topic  Reply to topic  [ 1 post ] 
Author Message
PostPosted: Tue Apr 14, 2015 7:43 am 
Offline
User avatar

Joined: Fri Feb 22, 2013 3:10 pm
Posts: 824
Location: Edmonton, Alberta
Original release date: April 13, 2015

Systems Affected
Misconfigured Domain Name System (DNS) servers that respond to global Asynchronous Transfer Full Range (AXFR) requests.

Overview
A remote unauthenticated user may request a DNS zone transfer from a public-facing DNS server. If improperly configured, the DNS server may respond with information about the requested zone, revealing internal network structure and potentially sensitive information.

Description
AXFR is a protocol for “zone transfers” for replication of DNS data across multiple DNS servers. Unlike normal DNS queries that require the user to know some DNS information ahead of time, AXFR queries reveal subdomain names [1]. Because a zone transfer is a single query, it could be used by an adversary to efficiently obtain DNS data.

A well-known problem with DNS is that zone transfer requests can disclose domain information; for example, see CVE-1999-0532 and a 2002 CERT/CC white paper [2][3]. However, the issue has regained attention due to recent Internet scans still showing a large number of misconfigured DNS servers. Open-source, tested scripts are now available to scan for the possible exposure, increasing the likelihood of exploitation [4].
Impact

A remote unauthenticated user may observe internal network structure, learning information useful for other directed attacks.

Solution
Configure your DNS server to respond only to zone transfer (AXFR) requests from known IP addresses. Many open-source resources give instructions on reconfiguring your DNS server. For example, see this AXFR article for information on testing and fixing the configuration of a BIND DNS server. US-CERT does not endorse or support any particular product or vendor.

https://www.us-cert.gov/ncas/alerts/TA15-103A

_________________
CF-52GUN

Life's Journey is not to arrive safely at the grave in a well preserved body, but rather to skid in sideways totally worn-out shouting 'Woo Hoo! What a ride!

Motorsports - the only real sport. If it doesn't have a motor, it is just a game.

There is always something waiting at the end of the road, if you are not willing to see what it is, you probably shouldn't be out there in the first place.


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 1 post ] 

All times are UTC-06:00


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Limited