From: Denis Jedig (djsyneticon.de)
Date: Tue Apr 03 2007 - 02:55:15 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Thu, 22 Mar 2007 11:35:18 +0100 Andres Tarasco wrote:

> By default, most Microsoft DNS servers integrated with active directory allow
> insecure dynamic updates for dns records.

This statement is way too broad. Creating an AD-integrated zone in Windows
Server 2003 does create a "secure updates only" zone by default. You can
influence this behavior in the zone creation wizard though.

> dnsfun exploits that weak configuration and allows remote users to modify dns records.

I am not sure if I do see the point in rewriting nsupdate from bindtools. I
am also quite uncertain if this really might count as a "hacker" or
"security" tool of any kind.

--
Denis Jedig
syneticon networks GbR http://syneticon.net/service/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]