Continued DoS seen on BIND8.2.2p7

[Paul Makepeace <Paul.Makepeace () REALPROGRAMMERS COM>]

My apologies if this has already been addressed; I didn't see anything
in the archives from a quick scan.

I was under the impression BIND8.2.2p7 was fixed re: recent DoS
exploits. I'm still seeing named die from time to time, always preceded
by the same signature:

Mar  3 13:09:56 tantrix named[9074]: bad referral (65.in-addr.arpa !< 224.65.in-addr.arpa)
Mar  3 13:09:56 tantrix named[9074]: bad referral (65.in-addr.arpa !< 224.65.in-addr.arpa)

This is Debian stable with a hand-rolled SMP routing 2.2.18 kernel.

$ dpkg -s bind | grep Version
Version: 1:8.2.2p7-1
$

Is this a new attack? I have added allow-transfer directives to
named.conf (finally :)

Cheers,
Paul

--
Paul.Makepeace () realprogrammers com
Thus spake the Master Programmer:
  "Let the programmers be many and the managers few --
      then all will
            be productive." (http://misspiggy.gsfc.nasa.gov/tao.html)