TippingPoint DNS Version Request increase
We have received a number of reports from TippingPoint customers that the normally quiet filter #560: DNS version request has been triggering in larger than normal numbers. The indications are that a large number of source IPs are involved, but the volume is not high enough to be of a concern for potential DOS. We have not yet been able to view any packets from this traffic.
If anybody has any more information, or packets we can review, we would love to hear from you.
The summary of filter #560 is:
"This filter detects a request to obtain the version number of the DNS Bind Server. The attacker uses the version information to determine whether the DNS Server is vulnerable to certain buffer overflow or Denial of Service attacks."
-- Rick Wanner - rwanner at isc dot sans dot org - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)
×
Diary Archives
Comments
Signature Total Events IP Srcs IP Dsts Sensor Latest Timestamp
GPL DNS named version attempt 76629 11383 55608 1 2012-07-22 07:43:06
from a quick look all packets appear identical.
Russell
Jul 21st 2012
1 decade ago
ponga
Jul 23rd 2012
1 decade ago
ponga
Jun 16th 2014
1 decade ago