Security Incidents mailing list archives

Re: DNS cache poisoning?


From: Joel Esler <eslerj () gmail com>
Date: Tue, 16 Aug 2005 12:27:15 -0400

Why are you using NT4?

..back to lurking...

On 8/15/05, Willard Van Dyne <wvandyne () hotpop com> wrote:
Good day!

Our DNS server has been crashing far too frequently as of late.
The OS is WinNT4 SP6.

Many of the error messages in the system log goes like this:

"6/26/05,1:43:58 PM,Dns,Error,None,5108,N/A,DNS,DNS Server created CNAME
loop loading CNAME at resalehost.networksolutions.com.. One link in CNAME
loop:  DNS name resalehost.networksolutions.com. is alias for CNAME
resalehost.networksolutions.com.. See adjoining messages for other links in
CNAME loop."

A Google search about the problem gets us reports that this looks like a
"cache corruption" vulnerability on Windows NT servers, and has to be patched.

Is this true in our case?
If so, why is networksolutions.com doing this?
If not, is our network under attack by some other means?

I hope someone can enlighten us. Thanks!






Current thread: