Does blocking TCP DNS packets keep your Bind safe?

[Don Kendrick <don () netspys com>]

OK, here I go again breaking things :)

Over the years I've argued about blocking icmp at the border routers. Steve 
Bellovin et al would usually argue that it breaks path MTU, etc. I'd 
usually argue that we can rely on path MTU being negotiated elsewhere in 
the path (LAN vs. WAN bandwidth)...but I digress

Here's what I am suggesting:

1. We should all only do zone transfers (TCP) with known secondaries.

2. Most if not all "normal" queries needed by legit Internet traffic are UDP.

Why not just block port 53 TCP connections at the border routers except for 
our secondaries. Is it possible to do a buffer overflow or other DNS/Bind 
exploit via UDP? I don't know the answer, I'm asking.

Don



Don Kendrick, CNE, CCNA, GCIA, CISSP

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://www.nfr.com/mailman/listinfo/firewall-wizards