<HTML dir=ltr><HEAD><TITLE>Re: [dns-operations] "Cybercrooks exploiting new Windows DNS flaw"</TITLE>
<META http-equiv=Content-Type content="text/html; charset=unicode">
<META content="MSHTML 6.00.6000.16414" name=GENERATOR></HEAD>
<BODY>
<DIV id=idOWAReplyText93646 dir=ltr>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2>Yes, if you are an ISP, registrar, DNS host, large company, etc. But not one of them are running external Windows DNS servers. I am referring to those small and medium size companies who use Windows for their internal and external DNS. As those will be the only people who would make a Windows DNS server Internet accessible. </FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr>
<HR tabIndex=-1>
</DIV>
<DIV dir=ltr><FONT face=Tahoma size=2><B>From:</B> dns-operations-bounces@lists.oarci.net on behalf of Roland Dobbins<BR><B>Sent:</B> Fri 4/13/2007 3:26 PM<BR><B>To:</B> dns-operations@lists.oarci.net<BR><B>Subject:</B> Re: [dns-operations] "Cybercrooks exploiting new Windows DNS flaw"<BR></FONT><BR></DIV></DIV>
<DIV><BR>
<P><FONT size=2>On Apr 13, 2007, at 1:23 PM, Stasiniewicz, Adam wrote:<BR><BR>> But the firewall rule is always UDP 53 inbound allow, drop <BR>> everything else. It goes without saying that there are also <BR>> stateful packet inspection rules.<BR><BR>This is categorically untrue. Many DNS servers have no firewalls at <BR>all in front of them (and rightly so, to avoid the DoS vector <BR>resulting from the additional sate), and as to the posited filtering <BR>policy, this is far from universal (it breaks truncate mode, for one <BR>thing).<BR><BR>-----------------------------------------------------------------------<BR>Roland Dobbins <rdobbins@cisco.com> // 408.527.6376 voice<BR><BR> Words that come from a machine have no soul.<BR><BR> -- Duong Van Ngo<BR><BR>_______________________________________________<BR>dns-operations mailing list<BR>dns-operations@lists.oarci.net<BR><A href="http://lists.oarci.net/mailman/listinfo/dns-operations">http://lists.oarci.net/mailman/listinfo/dns-operations</A><BR></FONT></P></DIV></BODY></HTML>