Web Wiz - Green Windows Web Hosting
Web Wiz Homepage Search Web Wiz

  New Posts New Posts RSS Feed - Windows DNS attack feared
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Windows DNS attack feared
 Post Reply Post Reply
Author
  Topic Search Topic Search  Topic Options Topic Options
iSec View Drop Down
Senior Member
Senior Member
Avatar

Joined: 13 February 2005
Status: Offline
Points: 1140 		Post Options Post Options   Thanks (0) Thanks(0)   Quote iSec Quote  Post ReplyReply Direct Link To This Post Topic: Windows DNS attack feared
    Posted: 17 April 2007 at 10:56am

Don't forget to install the latest critical updates off the windows updates site...

 
"When it gets dark enough, you can see the stars"
-Charles A. Beard
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844 		Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 17 April 2007 at 2:50pm
Microsoft haven't got a patch for it yet just instructions on how to lock down and secure your DNS server, which to be honest any good system admin would have or should have done already. 
Web Wiz Forums Hosting
ASP.NET Web Hosting
Back to Top
iSec View Drop Down
Senior Member
Senior Member
Avatar

Joined: 13 February 2005
Status: Offline
Points: 1140 		Post Options Post Options   Thanks (0) Thanks(0)   Quote iSec Quote  Post ReplyReply Direct Link To This Post Posted: 18 April 2007 at 9:04am

Right... everyone should have their firewalls on... I'll share the following info that was recently sent to me from my hosting provider:

Quote Dear Customer:

If you are not hosting a Dedicated Server which operates on Microsoft Windows Server Operating System, you may ignore this message.

It has been brought to our attention that Microsoft is investigating new public reports of attack exploiting a vulnerability in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server Service Pack 4, Windows Server 2003 Service Pack 1, and Windows Server 2003 Service Pack 2.

Please refer to Microsoft Advisory Article located at: http://www.microsoft.com/technet/security/advisory/935964.mspx

Fellow researchers at myNetWatchman are stating, that recently a flaw was discovered in the Microsoft DNS (Domain Name Services) Server's RPC (Remote Procedure Call) management server. This flaw is being actively exploited in the wild NOW on a limited scale but activity is expected to increase very soon. If your server is running Microsoft DNS Service with RPC over TCP (135/tcp) enabled with unrestricted remote access (e.g. NOT firewalled), then it is VULNERABLE TO THIS EXPLOIT. Compromise of this server could lead to compromise of ALL internal DNS clients that use this server as a DNS resolver!

As we always recommend, firewalling all servers with only necessary ports open is the best practice to follow. In this case if your Windows server is vulnerable if it is not firewalled properly.

We thank MyNetWatchman for proactive distribution of this information and Dan Kaminsky of DoxPara Research for this information.

If you suspect this server may already be compromised, feel free to run the myNetWatchman forensic scanner (SecCheck): http://mynetwatchman.com/tools/sc

If you are a Premier Managed Server Customer, the server management staff has already taken steps as recommended by Microsoft.

INFORMATION PROVIDED IN THIS EMAIL IS OFFERED TO YOU AS A CUSTOMER COURTESY. We do NOT GUARANTEE ACCURACY OF THIS INFORMATION. WE DO NOT HAVE FURTHER INFORMATION ON THIS MATTER AND THUS WE ASK OUR CUSTOMERS NOT TO OPEN SUPPORT TICKETS REGARDING THIS. OUR SYSTEM ENGINEERS WILL NOT BE ABLE TO ASSIST YOU WITH TASKS AND OR QUESTIONS RELATING TO THIS. PLEASE REFER TO MICROSOFT WEBSITE FOR MORE INFORMATION.


Customer Service
"When it gets dark enough, you can see the stars"
-Charles A. Beard
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844 		Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 18 April 2007 at 9:55am
Another option is run a different DNS server, for some of our DNS servers we are using Simple DNS which is much better than Microsoft DNS.

The few Microsoft DNS servers that we do use we only allow open port 53, port 135 which is used for RPC and not required for running a DNS server is not open. If you close port 135 on your firewall then you shouldn't need to worry about this threat.

If you are running a web server I would close all ports except the following (depending on which services you are running):-

80 - web server
21 - FTP
25 - SMTP
53 - DNS server
110 - Pop 3
143 - IMAP 4
220 - IMAP 3
443 - SSL pages
3306 - mySQL
1433 - SQL Server
3389 - Remote desktop

If you are not remotely connecting to any of the services above, like if you only connect to SQL server using localhost, don't open the port up for it.

You can also restrict things further for example if only yourself needs to have FTP access only allow FTP on port 21 for your own computer's IP address or IP range.



Edited by -boRg- - 18 April 2007 at 9:57am
Web Wiz Forums Hosting
ASP.NET Web Hosting
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.08
Copyright ©2001-2026 Web Wiz Ltd.

Become a Fan on Facebook Follow us on X Connect with us on LinkedIn Web Wiz Blogs
About Web Wiz | Contact Web Wiz | Terms & Conditions | Cookies | Privacy Notice

Web Wiz is the trading name of Web Wiz Ltd. Company registration No. 05977755. Registered in England and Wales.
Registered office: Web Wiz Ltd, Unit 18, The Glenmore Centre, Fancy Road, Poole, Dorset, BH12 4FB, UK.

Prices exclude VAT at 20% unless otherwise stated. VAT No. GB988999105 - $, € prices shown as a guideline only.

Copyright ©2001-2026 Web Wiz Ltd. All rights reserved.