Slashdot Mirror
Potential 0-Day Vulnerability For BIND 9
Morty writes "BIND, the popular DNS server software, has been crashing all over the Internet. The root cause is believed to be a 0-day vulnerability in BIND's resolver. The ISC has issued an alert. Quoting: 'An as-yet unidentified network event caused BIND 9 resolvers to cache an invalid record, subsequent queries for which could crash the resolvers with an assertion failure. ISC is working on determining the ultimate cause by which a record with this particular inconsistency is cached. At this time we are making available a patch which makes named recover gracefully from the inconsistency, preventing the abnormal exit.'"
Alert DJB at once!
I had to choose which DNS server I would deploy on my servers. I went for TinyDNS as it had all the same features and security promises. Man am I glad to have considered security over popularity.
Oh for fuck's sake, it's an assertion error. Get over yourself.
It's open source, and has had years to mature...so many eyes on it that this couldn't possibly happen.
We don't even know what is happening yet. Maybe it's just a DOS, maybe it's a potential exploit. What we do know is that no-one has any need to put recursive DNS servers on the internet unless they are running an ISP or a DNS service.
As opposed to the years of paid professionals eyes on Windows?
There are no loopholes. It's either legal or it's not.
Although we do know that if this was in a Microsoft product you wouldn't be making such an excuse.
Of course it can happen, it's just less likely to have problems than software with only a few sets of eyes on it. In addition, I had patches installed on my linux machines this morning, before I was even aware the problem existed. How's that for turnaround.
Devlopers should be liable up to the amount they charged you for the code, ie if the code fails to perform they have to give you a refund. It's wrong to demand payment for a product that doesn't work as it should (ie its broken).
Bind is given away free, and thus even if it fails, you've not paid for a broken product.
BIND is written by Internet Systems Consortium aka ISC, a non-profit that does various public benefit things for the Internet. The summary links to an alert from the Internet Storm Center aka ISC, a project of the SANS Technology Institute. There is no relation between these two ISC's, in this case the first authors the software, and the second tracks vulnerabilities. I'm sure by using a link to SANS many people on /. who are not familiar with these two ISC's will get them confused.
The link in the summary also goes to a preliminary version of the advisory. The correct, full summary is available on Internet Systems Consortium's web site as CVE-2011-4313.
I also think the characterization as a "0-day" isn't quite right. To me at least a 0-day issue is a bug that can exploited to do something, and that is used by bad-actors before the vendor is aware and able to fix the issue. In this case the bug simply crashes the server; there's no remote root or other exploit, and at this time there is no evidence of bad-actors using this bug at all. Rather it appears something interesting (unusual, perhaps put there intentionally) appeared in the DNS, and it triggered a bug in the software.
Some historical context may help. BIND8, for those who used it, was a pile of poo. It had a huge number of security issues and other problems and was generally a nightmare for sysadmins. Many people stayed on BIND 4.9.x for a very long time because of the issues in BIND8. When ISC launched BIND9, they wanted to change this perception. The action relevant to this bug is that BIND9 was designed to be full of assertions and other checks in the code. The goal was to catch any badness early, and if it was uncorrectable crash in a predictable way. The thought was that crashing with a core dump where you can fix the problem is far better than running off with bad data that could eventually be used in some sort of remote-root exploit.
This issue is sort of the payoff of that philosophy. Rather than taking this bad data and giving a remote hacker access to the machine BIND9 caught it with an assert, logs a useful message and core dumps. This is a big part of why 0-day leaves the wrong impression with me, "denial of service vector" seems to perhaps be a more accurate description. Sure, we could have a lively debate about if crashing is preferred or not, but I think most of the administrators who lived through BIND8 prefer the BIND9 procedures.
Internet Software Consortium also offers support for BIND (and DHCP). I'm amazed how many people run large, production name servers on BIND yet don't have a cheap support contract. If you run BIND, rather than getting your alerts via /. look into a support contract so you get them directly from the vendor.
Hurrr, well done guys. Now nobody can download the patches.
Someone want to set up some mirrors?
Finally had enough. Come see us over at https://soylentnews.org/
I can see this is going to be a long thread full of trolls about open source, but the fact of the matter is that an application "crashing" (really ABENDing) due to an assertion failure is actually a sign of software doing what it was designed to do. Assert statements are used to check for "impossible" conditions, and have the program scream and die if one is found. So what we have here is a careful programmer's backstop doing its job.
Although we do know that if this was in a Microsoft product you wouldn't be making such an excuse.
No excuse. This is a disaster and I'm not excusing it. However it doesn't affect most people who setup their systems right. ISPs, DNS service providers, and anyone who has to let random strangers on their network may well be in trouble with this.
Of course if this was Microsoft it would no doubt be an easy remote execution of arbitary code but only crazy people trust windows with something as critical as DNS in the first place.
Funny, that is not the argument given whenever there is a problem with closed source. Then it is always 'the developers should be liable for any damages caused by the bug'.
Open sores software == fail. Once again full of security holes that the "many eyes" failed to spot.
Unlike windows which never has remote crashes or remote execution of arbitary code problems. Tell me does microsoft.com still block ping? Why is that again?
APK's monolithic hosts file is looking pretty good at the moment.
However, BIND supports Response Policy Zones! Does TinyDNS support THAT? Without this critical capability, the entire internet is open to compromise, people could accidently visit evil hostnames! All Hail Vixie!!
I am confused - which was it designed to do: allow invalid data in the cache, or die when it found said invalid data in the cache? One or the other of those is a bug, not a design choice.
Your understated discretion just takes my breath away.
I also think the characterization as a "0-day" isn't quite right. To me at least a 0-day issue is a bug that can exploited to do something,
Something like cause a denial of service?
That's an excellent post, Above.
thanks!
use NSD. Sleep well.
www.nlnetlabs.nl/projects/nsd/
What we do know is that no-one has any need to put recursive DNS servers on the internet unless they are running an ISP or a DNS service
But the advisory talks of an "as yet unidentified network event", which implies the cause is as yet unknown. How can you be certain that only public recursive servers are vulnerable? FTFA, I don't even have enough information to know whether this is caused by a malformed query or a malformed response packet.
So, what do you know that the summary is not sharing?
Like "truly epic coronal mass ejections", lets save the hyperbole for when we can't use it. We'll know that there's a big problem when we can't read about it on Slashdot.
If you were blocking sigs, you wouldn't have to read this.
yes yes, but thats very limited. Yes, you can deny service.... but it can be started back up. The only loss is availability of the service, the integrity of the service is uncompromised. It isn't allowing someone to make you serve up their data, it isn't allowing anyone to dump data they shouldn't have, it isn't allowing them to change, erase or anything your data.
Essentially... a DDOS means you are hosed until they stop or you can upgrade... the term 0-Day tends to be used to refer to actualy security issues, where the denial of the service is the least of your worries. Patching isn't good enough because, they got a window in, and could have installed a root kit.
"I opened my eyes, and everything went dark again"
Except anyone with a resolver running BIND is potentially affected since all the attacker needs to do is point you at the invalid domain twice, that could be as simple as a webpage with the domain included and a meta refresh longer than the TTL on the domain.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Thanks for the clear explanation.
If you run BIND, rather than getting your alerts via /. look into a support contract so you get them directly from the vendor.
Very true. Its funny, that this morning I had applied security patches to a debian stable box and thought "hmm, looks like BIND is getting fixed, wonder what thats about" before this even got posted to slashdot.
Microsoft code would typically leave out the assert, and happily stumble along. At least with the assert, you know what AND WHERE the Bad Thing (TM) happened, and have a clue as to where to look to fix it.
The "assertion"-problem is only tip of the iceberg.
If an assertion fails, this usually means that someone managed to make the code behave in an unintended way. Since the affect occurred simultaneously at several providers all over the world, this indicates a coordinated attack. The chances are real, someone managed to exploit a buffer overflow (or similar) in BIND.
So we have to look seriously into the possibility that people have a way to execute code with the same permissions as BIND has.
When i got the information this morning, this was an alert topic.
Yours, Martin
I am 100% with you up until you say, "I'm amazed how many people run large, production name servers on BIND yet don't have a cheap support contract. If you run BIND, rather than getting your alerts via /. look into a support contract so you get them directly from the vendor."
I have a couple issues with this. The first is simply that it's perfectly reasonable to expect a good UNIX admin to handle BIND without issue for generalist deployments. The other issue I have is that you don't need a support contract to get these alerts. Sign up for the bind-announce mailing list (link: https://lists.isc.org/mailman/listinfo/bind-announce).
Again, I'm totally with you up until the end there.
I also think the characterization as a "0-day" isn't quite right. To me at least a 0-day issue is a bug that can exploited to do something,
Something like cause a denial of service?
The same can be done via a flood of packets that saturate either the machine (CPU) or the network to the machine.
A DoS is unfortunate and annoying, but a bug that leads to a ("clean") crash is in no way the same as an exploit. Heck, after an exploit it could be possible for the attacker to restart the service so the victim does not lose service (and thus is less likely to know that something occurred).
You would have to be a moron to run BIND for anything in the first place.
BIND the epitome of taking what should be a simple piece of software and turning it into an over-complicated, impossible to secure, impossible to debug, spaghetti coded piece of shit.
I mean BIND has been around for DECADES and there are still security vulnerabilities found all the time.
I am glad I took my lumps and disabled public recursive resolving many years ago on my BIND installations. Only do that for local IP ranges! This eliminates all the resolver issues. Also I found that when the DNS server was open I was getting a constant stream of unusual TXT lookups which were for oddball domains. These contained many K of data. I suspect these requests were fake source IP requests being used as some sort of bandwidth DOS attack.
Unbound, also from NL Netlabs, is a recursive resolver. NSD is an authoritative server.
The problem is with Bind as a recursive resolver, not as an authoritative server.
Yeah, but only the sheer incompetence a multi-billion dollar corporation like Microsoft could produce the level of spectacular FAIL needed to let the following kind of vulnerability go unaddressed for DECADES..
http://www.kb.cert.org/vuls/id/951982
Microsoft Windows UDP packet parsing vulnerability
You have to admit being able to get root by sending malicious packets to a CLOSED port on a machine is just so awesomely FAIL, BIND's little DOS exploit pales in comparison.
That's not how liability works. You are talking about some kind of warranty.
First, this has nothing to do with Microsoft, so there is no need to drag them into it.
Second, I am not questioning the need to test for errors, or that sometimes the correct thing to do when an error is encountered is die. I am challenging your position that overall the software is doing what it was designed to do and this is not a bug. The assertion itself is fine - there are reasons why the cache may have been corrupted and you want to kill the program (hardware error, tampering with files, etc). However, in this case the check should have been done BEFORE the data was put into the cache, when the correct response would have been to simply reject the message. Failure to do that check is a bug.
Because Microsoft is a monopolist? This reason alone is sufficient to treat them very differently than anyone else, especially a community effort.
I'm not sure how to square large production name servers with "generalist deployments". Clearly the small admin can do without a support contract. However I've seen large ISP's, supplying service to millions of customers with no support, and I think that's insane.
If you go back to ISC's Software Support page you'll notice "Advance Security Notifications". Depending on the nature of the issue, ISC's support customers often receive notification before BIND-announce. I believe this particular issue went out in all forums pretty much at the same time due to the severity, but lesser issues may be released in a staged fashion.
Also, note that in this case the assert did NOT tell them 'where the bad thing happened'. If it did, it would not be 'an as-yet unidentified network event'. The assert, in this case, is simply saying 'at some point in the past a bad thing happened, and I just figured that out now'.
By the way, another thing people who are wont to mess with their /etc should keep in mind is etckeeper. It versions your /etc, by default in bazaar, but it's also supposed to work with git, hg, etc. It has triggers set so every time you install something, it does an automatic checkin.
You can also manual commits, too, along with a message.
Good for people who want to know what the config files looked like when they were working a week ago.
Click to install (Debian and friends)
I'm not a lawyer, but I play one on the Internet. Blog
Instead of testing for known and unknown invalid data, it's the right way to test for valid data and puke on invalid data? In your code example, you wouldn't need to run that test because you already tested/trusted it somewhere else. If you know it is a lower case letter, the test isn't necessary. Data should be sanitized before it ever gets to your logic.
No, we don't.
Download Bind by Specific Version shows 9 was released 2004-Jan-28 07:05:51.
0-day used to mean that the exploit was release the day of release. Verses 1-day or later cracks.
Now it's just another throwaway term for exploit. And a very silly one at that.
(To be fair, it could be a problem with the last release from November 9th, 2011. I did not regression test this.)
Ahh. Point. I didn't realize that ISC support provided notifications in advance.
that link you posted says it was patched 2 weeks ago. It makes no mention of the date the exploit was found. How do you know this was part of the software for decades?
It pays to be obvious, especially if you have a reputation for being subtle.
To be honest I completely hate ASSERT-style checks, particularly in multi-user systems. One single logic mistake and boom goes the whole server. With exceptions you can at least have a gradual panic. But when you so often resort to pointer-magic and any unterminated string is a recipe for chaos, well... Though it would be nice if exceptions actually worked, which they don't in C++. Try/catching into some third party code and it'll still segfault on you, completely ignoring your attempt to catch any and all exceptions. Sigh.
Live today, because you never know what tomorrow brings
The point you are missing is "0-day" has come to mean vulnerabilities that can be exploited now for things like remote code execution, takeover, etc . In this case, the bug causes crashes but it is not clear that it makes the computer vulnerable to other security matters.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Hilarity ensues :P
I'm joking though... because that's just one tiny piece. The rest of the infrastructure is indeed eating it's own dogfood - either directly, or via "citrix netscaler"
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
How hard is it to write a DNS server without any vulnerabilities? I know it's complex, but still, come on. It's only the backbone of the Internet we're talking about.
when ever I think of BIND8, I think of my .sig:
The basic sleazeware produced in a drunken fury by a bunch of UCBerkeley grad students was still the core of BIND. --PV
There's a reason it's called the CIA triad... 0-day has no implications what so ever about the impact, just that a vulnerability was unknown to the vendor or researchers is being exploited in the wild.
The point you are missing is "0-day" has come to mean . . .
Actually, the best I can tell is 0-day has become so trendy it has no meaning at all. I'd prefer if people simply stopped using it. It provides me with zero information.
Well, how about this:
We learned about the issue because BIND developers elected to make BIND crash whenever something was wrong. Let's follow the logic that the crash was caused by something in some random zone, that all this resolvers looked up and choked upon. What if other nameservers are being compromised as we speak, because their designers elected to either run with bad data or not to try to detect bad data at all?
As a long-time BIND hater, I recently switched from djbdns/tinydns to NSD. I figured if it's good enough for a few root servers it was worth a look. It's very efficient and fast, uses standard zone files, fully ipv4/ipv6 dual-stack transparent, and is DNSSEC aware. Very pleased so far.
I'm an animal lover -- they're delicious!
Different from my understanding. You're thinking of 0-day warez. Here, WP explains it pretty well:
In short, knowledge of the vulnerability exists with attackers before developers. Developers developers developers developers.
Could someone edit that, actually? s/distribute a security fix/address the vulnerability/ If the developer is unaware, they're neither analyzing, patching, notifying users, nor advising workarounds, let alone distributing security fixes.
More to the point, since we have an advisory about it and there's a patch, it can no longer be considered zero day. A true zero day vulnerability is one that only the blackhats know about. Expanding that to include a vulnerability that the vendor doesn't yet understand well enough to patch makes sense. But anyone using the term for a bug that has a patch out to fix it is just being over-dramatic.
I've never known 0-day to mean that. 0-day has to me always meant an exploit in the wild before the author is aware of it vs. an exploit taking advantage of a bug that was fixed a month ago but people haven't applied the patch.
It has an atrocious security history. Seems the rewrite did not accomplish much. Or if you have to use it, lock it into a VM, preferably qemu, so that you get at least some level of isolation.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I use TreeWalk. Since it's an implementation of BIND, do I need to apply this patch to it, and if so how?
Did a little looking into it and, though I'm generally a fan of DJB's wares, unpatched qmail does indeed have the problem of accepting all mail for configured domains, regardless of localpart (box) validity. Which means DSNs will be sent for bad addresses, and since SMTP provides no way of validating senders, backscatter occurs. This is the term for it, by the way.
I've seen plenty of spam using the mechanism. It's a real problem.
Patches are available. But, yeah, DJB's licensing made even patching problematic for the longest time. Thankfully, he's conceded on that point. Which suggests to me he's not dogmatic or unreasonable, just rigidly principled.
I run Postfix, too. Love it. The licensing limbo was part of my decision to go with Postfix, though there were a number of factors. But I still run DJB's tinydns and dnscache.
Because patches were issued for all supported Windows versions, which implies the ones out of support most likely would have needed the same patches.
It is/was a 0 day exploit. ISC did not know what the hell happened while we were troubleshooting the issue and only knew because they received core dumps created from the crash.
Also tuesday night the only companies impacted were those in the USA. Cox, Rackspace, and others were having issues.
The interesting thing is that the day before the FBI announced busting a DNS jacking ring, then this happens.
Windows is not a single piece of software providing a single service though. I can understand something as complex as an entire OS having security bugs no matter how long it has been around. BIND has no such excuse, it's a simple service with a brain-dead implementation.
Repeat after me:
"There are no impossible conditions in input."
"There are no impossible conditions in input."
"There are no impossible conditions in input."
"There are no impossible conditions in input."
. . .
So you're releasing your debug version of the code as a product? Nice.
So basically, a cron job running once a minute to check for a running bind instance and restart it if not would correct the issue. Oh, and here's a script to make it work if it's not perfect, it's pretty close....
if [ `ps -ef | grep -i named | grep -cv grep` -neq 1 ] /var/log/named_monitor.log /usr/sbin/named
then
echo " Bind died, restarting " >>
exit 1
fi
exit 0
I don't *think* you guys understand HOW I utilizing a HOSTS file, because of what you said about it being "monolithic" - I don't use it as a "DNS substitute" for all addresses possible online (because I would even find THAT HILARIOUS to try to do from a HOSTS file)!
FOR SECURITY:
I just do NOT setup local ones @ home (no point to burn the extra CPU cycles, & thus, electric power, or RAM + other forms of I/O used in them).
I do so for security, and just because of things like:
1.) This issue (it has a patch by the way) & vs. this, & the other numerous troubles in BIND over time, which are numerous (another 'case-in-point'/e.g. is "the Kaminsky Flaw" & other redirect/dns-poisoning attacks that have happened over time the past few yrs. now).
2.) I currently BLOCK OUT 1,624,230++ KNOWN BAD SITES/SERVERS/HOSTS-DOMAINS in it that are KNOWN to serve up malicious exploits of various types in it, mostly... this is for security purposes, & specifically what's called "Layered-Security"/"Defense-in-Depth" security.
FOR EXTRA SPEED:
A.) I "hardcode in" about 250 of my FAVORITE sites into it (where I spend 99% of my time online), but, I don't attempt to "resolve the entire internet" via HOSTS either (which is what it sounds like you're thinking)... Doing this results in FASTER ONLINE WEBSURFING PERFORMANCE & is faster resolutions of hosts-domain names to IP Addresses, by far, than calling out to a remote DNS server, by orders of magnitude, & runs LESS RISK of being infested via redirected/DNS-poisoned ones too as noted above.
B.) For blocking out adbanners, which have housed malicious script code in them MANY times in the recent past & before that even (last 8 yrs. or so I have records of this in multiple occurences for example), & for the fact that adbanners take away bandwidth & speed YOU THE USER PAY FOR OUT OF POCKET!
In fact, for websurfing? By feel alone, I can basically get as fast as any FIOS connection because of this, & getting ALL of the possible bandwidth I paid for...
By the by: I do utilize DNS servers (albeit, 'external' ones/non-local to my computer here):
Norton DNS:
https://dns.norton.com/dnsweb/homePage.do
Open DNS:
https://store.opendns.com/get/basic
ScrubIT DNS:
http://www.scrubit.com/
In a "truimvirate formation" (w/ in my Windows IP DNS settings + Hardware Router firewall)
Why?
Simply because they FILTER OUT known malicious sites threats too (phishing, spamming, & other malicious things like scripts for attack or that serve malware etc.).
* Anyhow/anyways: HOSTS work, & for extra speed & security online!
(It just works... especially mine since it's been built since 1997 for the above, & gets stronger every 15 minutes - plus it uses 0.0.0.0 for faster parsing, & I cut the local DNS cache in Windows (slows down on larger HOSTS files) & cache it like any file is cached, via the local kernelmode diskcache subsystem for reads/subsequent re-reads...!)
APK
P.S.=> I have it FULLY automated too, every 15 minutes it's being fed with data to block out adbanners + known malicious servers noted above from a pristine TEMP/SCRATCH copy from 17++ reputable & reliable sources for that in fact!
I don't lift a finger to do it - pure "automagic" operations & has been since oh, roughly/approximately 2002 or thereabouts!
(E.G./I.E.-> From 1997-2002 I built it using MS-Access for removal of duplicates, then Delphi app 2002-2010 which was FINE for the smaller lists of that data the way I built it's deduplication/normalization algorithms).
Now, it's built in a system that my nephew & I co-wrote in Python (I stuck by it because it's set deduplication/normal
No it doesn't. It could have easily first appeared in the oldest of the supported OSes, or via a new feature (like IE) that is only supported on the listed OSes.
Gamingmuseum.com: Give your 3D accelerator a rest.
Oh, and the list doesn't include XP, which is supported as long as you are on the last service pack, or Windows Server 2003. So the vulnerability first appeared in some service level of Vista.
Gamingmuseum.com: Give your 3D accelerator a rest.
"guest appearance?" Who the fuck are you?
And why do you bother posting anonymous coward when you sign your name AND append it to the subject line? You are so gee-whiz smart you can block a million domains via a hosts file or whatever, yet you can't sign up for a slashdot account?
ANSWER = An "AC" off-topic illogical adhominem attack using troll, telling me to use a "registered 'luser'" account here?
You post as ac, & yet U rib on me for doing it too??
Please... lol!
* Besides, & above all else here? Your off-topic illogical adhominem attack is the typical effete "last resort" of the blown away troll!
Especially vs. the facts in my initial post you responded to here http://it.slashdot.org/comments.pl?sid=2531162&cid=38090616 which whose enumerated facts listed you are WELCOME TO DISPROVE, & my noting that's good enough of a reply to you from myself & all you'll get in response from myself - that challenge in bold above...).
APK
P.S.=> Troll away if you wish, it's useless & WEAK... That is, unless you feel like disproving the known facts I enumerated in my initial post (in the link above) that you replied to, & good luck: YOU'LL NEED IT!
(Simply because it's IMPOSSIBLE to refute is why, & many trolls who post ac & don't even "sign off" on them as I do have tried, & each has failed, miserably, every time).
Man - Your "kind" online? LMAO - In a way, I have to THANK YOU... Why?
Because you truly DO make me laugh (& yet you also make me look good, especially on HOSTS files posts I do).
Ah, in the end here? Well... you KNOW I just GOTTA say it, as-is-per-my-usual "style" vs. off topic easily defeated illogical adhominem attack utilizing trolls such as yourself:
This was just "too, Too, TOO EASY - just '2EZ'"
Disprove the data I put up on HOSTS files here:
http://it.slashdot.org/comments.pl?sid=2531162&cid=38090616
And, in every point made by myself there on HOSTS files' value as a "layered-security"/"defense-in-depth" tool that can also yields FAR BETTER SPEED ONLINE as well?
* You only make ME look good - just because you're yet another EASILY FLOORED TROLL that you are demonstrating yourself to be!
APK
P.S.=> Ah, man... This? THIS WAS JUST "too, Too, TOO EASY - just '2EZ'", as it always is vs. trolls like youself that utilizing off topic illogical adhominem attacks when they're confronted with facts... apk
Disprove the data I put up on HOSTS files here:
http://it.slashdot.org/comments.pl?sid=2531162&cid=38090616
And, in every point made by myself there on HOSTS files' value as a "layered-security"/"defense-in-depth" tool that can also yields FAR BETTER SPEED ONLINE as well?
* You only make ME look good - just because you're yet another EASILY FLOORED TROLL that you are demonstrating yourself to be!
APK
P.S.=> Ah, man... This? THIS WAS JUST "too, Too, TOO EASY - just '2EZ'", as it always is vs. trolls like youself that utilizing off topic illogical adhominem attacks when they're confronted with facts... apk
n/t
Good thing I chose Unbound when I set up my server... It's non-authoritative, but it works for what I need it for.
Its funny, that this morning I had applied security patches to a debian stable box and thought "hmm, looks like BIND is getting fixed, wonder what thats about" before this even got posted to slashdot.
Same here. Debian rules! :)
"For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
I've heard people complain that a website named slashdot.org serves malicious software, could you add it to your list please ?
Submitter here. Comments:
0-day refers to the time when the bug is first exploited relative to when it is patched by the vendor. It has nothing to do with whether or not the exploit yield unauthorized access. It is entirely possible to have a 0-day DoS attack.
There was no evidence on whether or not the bug was triggered deliberately. Hence why the summary referred to it as a "potential" 0-day, and said the problem "is believed to be" a 0-day vulnerability.
At the time crashes were initially occuring, no patch existed. That made it a 0-day, assuming
SANS is a well-known security organization. Hopefully folks who care about this sort of thing are aware that isc.sans.edu is not the same entity as isc.org.
This is a "news for nerds" site. Plenty of folks aren't running BIND 9 directly from isc.org at their workplaces. Perhaps they are using distribution-bundled BIND, or they're running BIND 9 at home, or they're not running BIND 9 at all and are just curious about major vulnerabilities. I know I like to read about flaws in major Internet software even for packages I'm not running.
See subject-line above: /.'s in my HOSTS, except access to it's sped up via hardcodes (for extra speed of access to it!) - inclusive of its "main domain/site" & all "sub-domains/sites" as well... (using the terms 'loosely', hence the quotes).
* There you go... always 1 step ahead here!
APK
P.S.=> Once again, I don't think you understand how HOSTS files work, & you may need to refer to this & read it -> http://it.slashdot.org/comments.pl?sid=2531162&cid=38090616
... apk
http://it.slashdot.org/comments.pl?sid=2523490&cid=38047978
* So much for your b.s., & your "credible" (lol, not) so-called "sources"...
(Your off-topic illogical adhominem attack attempts ALWAYS fail, just as you always do ac psycho-stalker troll, vs. myself)...
APK
P.S.=> You KNOW I've just GOTTA say it, as-per-my-usual style vs. yourself (the ac psycho-talker troll I have here on this site) -> This? This was just "too, Too, TOO EASY - just '2EZ'"
...apk
OpenBSD 5.0 with BIND, does it affected too?
See subject-line above...
APK
Ur evading disproving my points on HOSTS here http://it.slashdot.org/comments.pl?sid=2531162&cid=38091706 is only proving my point also - thanks!
* You only continue to make me look good...
APK
P.S.=> I don't know where this "mummy" crap comes from out of yourself either, but I own my home and don't live in a basement (quit projecting)...
... apk
Seeing you run from this is priceless http://it.slashdot.org/comments.pl?sid=2531162&cid=38097258
* You were asked there to disprove my points on HOSTS files on how they gain you better online speed, and also "defense-in-depth"/"layered-security" benefits as well vs. online threats too - funny how you RUN from disproving them!
(Especially since you saw fit to try to "cut me down" & the topic here's on HOSTS file which Culture20 brought up)
I also list better DNS servers for security there also, that filter vs. online threats (also how to use them in layered security fashion as well)...
Top that off with using firewalls for purposes of security too (vs. IP address based threats, if not hosts-domain based ones too for layered security)? Well... your running away's "proof in the pudding" & proves my points, in that all you have is off topic bs as per your online psycho stalker illogical adhominem attacks as usual - U FAIL.
APK
P.S.=> Off-Topic illogical adhominem attacks from ac "psycho-stalker" trolls like yourself always make me laugh...
... apk
http://it.slashdot.org/comments.pl?sid=2531162&cid=38097258
APK
P.S.=> I'm far from upset - I am actually laughing, because seeing you run from the challenge in the link above is utterly hilarious, & even MORESO watching you stay off topic with your illogical adhominem attack attempts on myself (seek professional help of somekind please, you need it imo)...
... apk
http://it.slashdot.org/comments.pl?sid=2531162&cid=38091706
APK
P.S.=>
"You're really not good with sarcasm, are you ?" - by Anonymous Coward on Friday November 18, @10:08AM
You're not really good with facing up to facts on the topic @ hand Culture20 the initial poster on HOSTS files brought up, & YOU being challenged to disprove my points regarding HOSTS files benefits for added security & speed for folks, are you?
Still - Thanks for proving my point that you're some sort of obviously "mentally troubled" individual that has nothing left but off-topic illogical adhominem attacks to attempt to direct my way (& my easily disproving them)... it's hilarious watching you run from that challenge above also!
I mean, please - the way you post as a TRULY "anonymous coward", with no indicator of who you really are, and your stalking me here on slashdot like somekind of online "psycho-stalker"? Man...
Seriously - You have issues!
So - once more, seek some sort of professional help (imo, you truly require it)...
... apk
People who use asserts in fielded code are either (1) lazy or (2) dumb or (3) cheating their employers.
Assuming performance isn't a problem, why wouldn't you leave them in on the off chance that you made a mistake in a corner case somewhere?
You're not really good with facing up to facts on the topic @ hand Culture20 the initial poster on HOSTS files brought up
Seriously ? Using an obviously sarcastic post that is modded '+5 Funny' as evidence of you being relevant ? You're too sarcastic dude, even for me ...
the way you post as a TRULY "anonymous coward", with no indicator of who you really are
Which part of "anonymous" and "coward" didn't you understand exactly ?
...
... were you being sarcastic again ? hehehe you got me on this one dude
Oh wait
Based on your success using a HOSTS file for added speed - you can also get more "layered-security"/"defense-in-depth" added as well, & here are some of the sites I use online to populate my HOSTS file vs. various online threats (all current, updated regularly, & reputable):
http://hosts-file.net/?s=Download
http://winhelp2002.mvps.org/hosts.htm
http://someonewhocares.org/hosts/
http://www.malwaredomainlist.com/hostslist/hosts.txt
https://spyeyetracker.abuse.ch/monitor.php
https://zeustracker.abuse.ch/monitor.php?filter=all
http://amada.abuse.ch/palevotracker.php
http://www.malware.com.br/cgi/submit?action=list_hosts_win_0000
http://www.safer-networking.org/en/download/
http://www.malwareurl.com/
http://mirror1.malwaredomains.com/files/
http://hostsfile.org/hosts.html
http://doc.emergingthreats.net/bin/view/Main/HoneywallSamples
* There you go - that'll "get you started" on the road to not only FASTER websurfing, but also SAFER websurfing as well...
APK
P.S.=> Now, as far as "integrating" them into your HOSTS file?
Those sites offer various tools for that (I have built my own over time & you can even use tools like MS-Access for the hard part, deduplication for unique entry data via SELECT DISTINCT queries if need be, but I think the best tool offered on 1 of those sites is a PERL deduplication script (you have to have PERL installed though) as far as the tools offered by others from those sources.
Thus, You may wish to look into the FREE tools offered on those sites, if not compare them as well, & just for the purposes of import, deduplication/normalization, + more as well!
So - enjoy & continued good luck to you (as well as "salutations" for trying a custom HOSTS file & experiencing what you have, thusfar)...
... apk
http://it.slashdot.org/comments.pl?sid=2531162&cid=38091706
* This? As-per-my-usual, vs. yourself (the off-topic illogical adhominem attack utilizing ac troll that stalks me all over /., which you have proven already in the links you post which I disprove easily in their bs)?
Well, you KNOW I have to say it... lol: This was just "too, Too, TOO EASY - just '2EZ'"...
APK
P.S.=> See subject-line above, & that link I just posted - then again, you have, & are unable to disprove my points on HOSTS files (as you always are shown to run from, everytime)... like I always say, your doing so only makes me look good here & proves my points for me!
...apk
P.S.=> See subject-line above, & that link I just posted - then again, you have, & are unable to disprove my points on HOSTS files (as you always are shown to run from, everytime)...
Peter, you hurt my Anonymous Coward feelings here, how many times do I have to tell you: many have disproven most of your points and you just ignored them and kept yelling at them (followed by your usual homophobic-driven insults, of course). Now we don't care anymore do disprove them again and again and again as we did so often in the past. We just want you to add
0.0.0.0 slashdot.org
in your host file.
Really that's all there is to it.
As for running away, I'd like you to answer these my dear:
http://it.slashdot.org/comments.pl?sid=2531162&cid=38099124
http://it.slashdot.org/comments.pl?sid=2531162&cid=38098256
which you just seem to run away from ...
http://it.slashdot.org/comments.pl?sid=2531162&cid=38091706
* We would like to see you do that, because for once, it'd at least see you making an honest attempt to be on topic here for once, troll... Especially after your utter line of evasive b.s. here requoted:
"many have disproven most of your points" - by Anonymous Coward on Friday November 18, @11:55AM (#38099858)
OH, really? Then let's see YOU do so... ok?? You'll just post more b.s. & I am going to stop posting because I've made my point here & your evasions help me do it (that you're an off topic troll who is soundly beaten by his own stupidity).
APK
P.S.=> Of course, we'll never see you even try - it can't be done is why, lol... apk
"1st they ignore u, then they laugh at u, then they fight , then u win" -> http://it.slashdot.org/comments.pl?sid=2531162&cid=38091706
To disprove apk's points on HOSTS files here http://it.slashdot.org/comments.pl?sid=2531162&cid=38091706 since that's all the proof anyone here requires that you are not only an off topic troll but also a technically weak one on your part.
Paul Vixie is famous for his crappy software, as well as his attempts to manipulate the news and sling mud at his opponents when BIND bugs are revealed (which happens quite often). Read DJB's (Daniel J. Bernstein) articles, and look at the djbdns suite. I would never install BIND anywhere. It's not only buggy, it's a stupid, poorly designed piece of software that a normal person (but not sociopaths like Paul Vixie) would be ashamed of.
*Another* BIND bug? Why do people still use this crap?