Bugtraq: Re: your mail

[Alain.Thivillon () HSC FR (Alain Thivillon)]

Anonymous <nobody () REPLAY COM> écrivait (wrote) :

> commit the sin of "the processing of NXT records"?  In other words,
> are all of us vulnerable (even caching-only name servers if so, I
> imagine!), or only people with NXT records?  This makes a big difference!
[ NB : I can be wrong, don't flame me :) ]

Examing diffs between 8.2.1 and 8.2.2PL3 show rewrite of code handling
external response to an NXT query coming from bind himself (see
bin/named/ns_resp.c). So i suppose, if your name server is public and
recusive, external attacker can query your bind for NXT record in
another zone. If he has control of name server of this zone, he can
send offending responses and trigger bug.

I suspect every public server with 8.2 <= bind < 8.2.3PL3 is vulnerable.