BIND exploit

Lest all Linux monks panic, this exploit will only affect you if you're a) running BIND, and b) exposed directly to the internet.

If you don't need to be running BIND, turn it off. (Repeat this advice for all services you don't need.)

Saturday morning update: Yesterday I warned several Linux-running friends who don't typically pay attention to happenings in the outside world. Two have reported that they've been hacked.

PAY ATTENTION TO THIS ONE.

Comment on BIND exploit

Replies are listed 'Best First'.
Re: BIND exploit by deprecated (Priest) on Mar 25, 2001 at 00:45 UTC
Um, I hate to beat an offtopic horse... But, it also doesnt affect you if you arent running an i386 platform. Presumably this program is not installing source, compiling that source, and then causing problems. I run bind 9 at home so it isnt an issue, but should I have been exposed to the security hole, the programs mentioned on the t0rn rootkit homepage do not affect me -- I run a PowerPC router/firewall at home. sigh Why cant we just use our powers for good instead of evil? brother dep. -- Laziness, Impatience, Hubris, and Generosity.	[reply]
Re: Re: BIND exploit by strredwolf (Chaplain) on Mar 25, 2001 at 04:37 UTC
The exploit, according to Wired News, affects all archetectures that can run BIND, including FreeBSD, Ultrix, Solaris, etc. It may be a short amount of time before they sneak in something Javaish. -- $Stalag99{"URL"}="http://stalag99.keenspace.com";	[reply]
Re: Re: Re: BIND exploit by deprecated (Priest) on Mar 25, 2001 at 05:17 UTC
Heya strredwolf, I really only replied to this because I want to make it clear to people who might not know the whole story to this. This thread is really offtopic. That having been said, I want to restate what I said, which is a non-i386 machine that runs the old BIND is vulnerable to something nasty happening. However, this particular worm uses the 't0rn' rootkit. This particular rootkit makes use of i386 binaries. This means that you must meet two qualities to be susceptible to this worm: run BIND < 9.0 and be on i386. BIND exploits are universal because the software is running. update: probably you would also have to be running a redhat based distro or have your syslogd and other files in the standard places (such as logs and binaries), as well as not firewalling ports youre not using. this kind of worm makes people running the default install very very easy targets. you cant hurt what you cant see... The same applies to java. It just isnt applicable if the platform in question doesnt have a jre (or is the term jvm? ive lost track of all the javalingua). Let us not forget that the media is hype-centric. They would like to tell us that there is a security exploit in the sky and that soon it will be falling on all of us. all of us. In truth this is an overstatement, but the details get omitted as they are largely not relevant to many people (such as those who promptly told me in the CB that nobody they know uses linux on non-i386). deprecated removes the dead horse from everyone's sight to prevent further beatings... brother dep. proud supporter of unix on PowerPC -- Laziness, Impatience, Hubris, and Generosity.	[reply]